The npm package 'dolyame-boxy-desktop-bnpl-card-panel' version 35.6.3 contains malicious code that auto-executes upon installation or requiring the package. It downloads attacker-controlled payloads using obfuscated runtime hostname assembly and a DNS-TXT covert channel fallback. The payload is saved to disguised filenames on the local system and executed detached, enabling stealthy code execution.