The npm package dolyame-boxy-mobile-bnpl-card-gallery version 35.9.5 contains malicious code that downloads and executes an opaque binary from obfuscated Cloudflare Workers subdomains. The binary is saved to temporary system directories with disguised filenames and executed without verification, enabling potential unauthorized code execution. The package also includes a duplicate drop-and-execute routine disguised as an analytics SDK. No official patch or remediation guidance is provided.