The npm package dolyame-boxy-atom-bnpl-navigation-arrow version 35.6.5 contains malicious code that downloads and executes a platform-specific executable from attacker-controlled Cloudflare Workers hosts. If the primary download fails, it uses a DNS-TXT record covert channel to retrieve and execute the payload. The malicious executable is saved to temporary directories with names mimicking legitimate files and executed detached from the main process. The package appears to be a typosquatting or dependency confusion lure.