The npm package dolyame-boxy-independent-bnpl-video version 35.4.4 contains malicious code that downloads and executes an opaque binary payload from obfuscated Cloudflare Workers hosts and fallback DNS-TXT sources. The payload is saved under decoy filenames in temporary directories, given executable permissions, and spawned detached from the main process. The code uses string-splitting and runtime assembly to hide destination hostnames and module names, masquerading as telemetry or analytics functionality. This behavior identifies the package as a supply-chain dropper rather than legitimate software.