The npm package dolyame-boxy-mobile-bnpl-card-panel version 35.3.4 contains malicious code that downloads and executes attacker-controlled binaries at load time. It fetches platform-specific binaries from hardcoded Cloudflare Workers endpoints or, if those fail, uses a covert DNS-TXT channel to retrieve and execute base64-encoded payloads. The package masquerades as a payment or device integration library but performs unauthorized remote code execution by writing and spawning disguised executables on the host system.