The npm package 'dolyame-boxy-independent-bnpl-title' version 35.7.3 contains malicious code that, upon requiring the package, downloads and executes attacker-controlled binaries from Cloudflare Workers subdomains or via a DNS covert channel. The malicious payload is saved to disguised filenames and executed detached from the main process, enabling remote code execution on the host machine. This behavior is consistent with a hostile dropper delivering unauthorized code at package load time.