{"id":"MAL-2026-13330","summary":"Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3)\ndolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from array-fragment string joins (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) to defeat literal-string scanning, downloads a per-platform binary payload, writes it to /tmp as a hidden dotfile on Unix or to the Windows temp directory as dotnet_diag_*.exe, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe. When HTTPS delivery fails, it falls back to a DNS TXT covert channel against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru: it reads a record count from c.\u003cdomain\u003e and reassembles base64-encoded binary bytes from numbered TXT records. The fetched code is unpinned, unsigned, and unrelated to the package's declared BNPL swagger purpose. A separate lib/telemetry.js bundles the same drop-and-exec primitives (fs[\"chmod\"+\"Sync\"], cp.spawn(\"/bin/sh\", [\"-c\", filePath+\" &\"])) using bracket-string reconstruction; it is not reachable from the current main entrypoint but is staged in the tarball.\n","modified":"2026-08-05T16:50:56.254407102Z","published":"2026-08-05T15:20:44Z","database_specific":{"malicious-packages-origins":[{"versions":["35.6.8"],"id":"IN-MAL-2026-015662","import_time":"2026-08-05T16:13:29.504731565Z","modified_time":"2026-08-05T15:20:44Z","sha256":"8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-independent-bnpl-swagger/v/35.6.8"}],"affected":[{"package":{"name":"dolyame-boxy-independent-bnpl-swagger","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-independent-bnpl-swagger"},"versions":["35.6.8"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"f020237341f65a3b3d09b7118c67830a4796c0b94f525dd8253649ce0a4a62bb","tlsh":"cfa1b76a16aa30198bb0d7f48717581af55bf2633380c5d8fb5c65980fb212483b2efc","path":"setup.js"},{"sha256":"d84adfce49a07956a0495a3e1354a72931de83b79d772173ace39746df6ea8fd","tlsh":"4b835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}],"package_integrity":[{"filename":"dolyame-boxy-independent-bnpl-swagger-35.6.8.tgz","hashes":{"sha1":"de21b7999ef0c50183c21844e8463ed504985e76","sha512_sri":"sha512-RtYnmTuvOOu2efp2r+/fZGF4bPJ5p9mV3HLBGGnoJKfrcqK539XLaTKLwQHuk6GnQTNIDl135VjANvRTQxoWGA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-independent-bnpl-swagger/MAL-2026-13330.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}