The npm package 'dolyame-boxy-stories-of-block' version 35.8.6 contains malicious code that downloads and executes platform-specific binaries from remote servers without integrity verification. It writes these binaries to temporary locations on the host system, sets executable permissions, and runs them detached from the main process. The package uses obfuscated hostname reconstruction and mimics system artifacts to evade detection, presenting itself as an analytics SDK. A secondary module performs similar malicious actions with payload chunking and endpoint rotation.