The npm package dolyame-boxy-independent-bnpl-table version 35.3.4 contains malicious code that, upon require(), downloads and executes an obfuscated platform-specific binary payload. The payload is fetched from dynamically assembled Cloudflare Workers hostnames with a DNS-TXT fallback resolver, saved to temporary directories under disguised names, permissioned for execution, and spawned detached. The package masquerades as an analytics SDK, honoring environment variables to disable telemetry as a cover story. A second bundled module exhibits similar malicious behavior with additional obfuscation. The package name and framing do not correspond to the observed malicious activity.