The npm package dolyame-boxy-stories version 35.9.7 contains malicious code that downloads and executes a remote binary at load time. This binary is fetched from attacker-controlled hosts using obfuscated domain names and a DNS TXT-record fallback. The binary is saved to temporary directories with disguised filenames, given executable permissions, and executed detached from the main process. The package falsely claims telemetry-related functionality to disguise its true behavior. This results in a full-host remote code execution (RCE) dropper upon requiring the package.