The npm package dolyame-boxy-block version 35.5.2 contains malicious code that executes remote code on any system importing it. It downloads and runs attacker-controlled binaries from obfuscated hostnames or retrieves payloads via DNS TXT records, then writes and executes these payloads on the local machine. The package's advertised functionality does not match its behavior, indicating deliberate deception. This results in full-host remote code execution upon requiring or importing the package.