The npm package dolyame-boxy-independent-bnpl-swagger version 35.6.8 contains malicious code that downloads and executes untrusted binary payloads from remote hosts. The package's setup.js reconstructs obfuscated hostnames to evade detection, downloads platform-specific binaries, writes them to temporary directories, sets executable permissions, and executes them detached from the main process. If HTTPS delivery fails, it uses a covert DNS TXT record channel to retrieve the payload. The malicious payload is unrelated to the package's declared functionality and is unsigned and unpinned. A secondary malicious module with similar capabilities is present but not currently reachable from the main entry point.