The npm package dolyame-boxy-independent-bnpl-faq version 35.8.7 contains malicious code that downloads and executes opaque native binaries from obfuscated Cloudflare Workers hosts and fallback DNS-TXT records. The payload is saved to temporary directories and executed detached from the main process, bypassing static detection methods. The package's stated purpose is unrelated to this behavior, indicating deliberate malicious intent.