The npm package dolyame-boxy-markdown version 35.9.4 contains malicious code that downloads and executes platform-specific native binaries from author-controlled Cloudflare Workers subdomains without verification. The binaries are saved under disguised filenames in temporary directories and executed detached from the main process. The package masquerades as a markdown provider but performs unauthorized remote code execution, which is unexpected behavior for its advertised functionality.