The npm package dolyame-boxy-mobile-bnpl-footer version 35.4.7 contains malicious code that downloads and executes platform-specific executables from attacker-controlled endpoints. The package masquerades as a payment/BNPL footer component but performs unauthorized actions including fetching payloads from multiple domains, reconstructing payloads from DNS TXT records, writing them to hidden files, setting executable permissions, and spawning them detached from the main process. This behavior is designed to evade static inspection by dynamically constructing hostnames, function names, and file paths.