The npm package dolyame-boxy-component-story-name version 35.3.3 contains malicious code that covertly fetches and executes attacker-controlled binaries on the host system during import. It reconstructs Cloudflare Workers hostnames from fragmented strings to download a platform-specific executable, writes it to a hidden temporary file, sets executable permissions, and runs it detached from the parent process. A parallel dropper in telemetry.js uses obfuscated code to perform similar actions. This behavior results in arbitrary code execution on the installer's machine without user knowledge.