Malware in dolyame-boxy-atom-bnpl-dolyame-button

A malware-containing package named dolyame-boxy-atom-bnpl-dolyame-button was identified in the npm ecosystem and reported via GitHub Advisory GHSA-p8jq-ggcc-9fvg on August 5, 2026.\n\nAccording to the advisory, any computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems.\n\nImmediate action is required: all secrets and keys stored on affected computers must be rotated from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the initial compromise.