The npm package 'dolyame-boxy-independent-bnpl-separator' version 35.2.6 contains malicious code that acts as a cross-platform binary dropper. Upon loading, it reconstructs command-and-control hostnames, downloads a platform-specific binary, writes it to temporary directories under disguised names, sets executable permissions, and executes it detached from the main process. The package masquerades as a BNPL/payment integration library but delivers obfuscated malicious infrastructure.