The npm package dolyame-boxy-atom-bnpl-store-button-set version 35.9.5 contains malicious code that, upon require, downloads and executes a platform-specific native binary from suspicious anonymous worker hosts. The payload is saved to temporary directories under disguised filenames, given executable permissions, and launched detached from the main process. A covert DNS-TXT channel is used as a fallback to retrieve base64-encoded payload chunks from multiple domains. Execution is controlled by filesystem stamps and environment variables masquerading as telemetry opt-outs. The package falsely advertises itself as data-store bindings but performs unauthorized code execution at require time.