The npm package dolyame-boxy-scroll version 35.9.9 contains malicious code that downloads and executes an attacker-controlled binary on the host system. Instead of providing the benign scroll abstraction described in its README, the package loads a platform-specific binary from Cloudflare Workers hosts, saves it under a disguised name in temporary directories, sets executable permissions, and runs it detached. If the HTTPS fetch fails, it uses a DNS-TXT record fallback to reconstruct the payload. The downloaded binary is not verified by hash or signature, allowing arbitrary code execution upon import of the package.