{"id":"MAL-2026-13338","summary":"Malicious code in dolyame-boxy-mobile-bnpl-card-gallery (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80)\nOn require of the package, _bootstrap.js fetches an opaque binary over HTTPS from a rotating list of Cloudflare Workers subdomains (with a DNS-TXT chunked-retrieval fallback to *.wel1.ru), writes it to /var/tmp/.cache_\u003crand\u003e or %TEMP%/dotnet_diag_\u003crand\u003e.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames and API names are string-concatenation-obfuscated (host fragments joined via.join(\"\"), require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to evade static inspection. The destinations are anonymous workers.dev endpoints unrelated to the package's stated purpose (\"mobile SDK\"); no hash or signature verification is performed and the payload path uses hidden dot-cache or.NET-diagnostic-lookalike names. lib/telemetry.js ships a duplicate copy of the drop-and-exec routine wrapped in an \"Analytics SDK\" comment block as an alternate payload carrier.\n","modified":"2026-08-05T16:51:00.098286439Z","published":"2026-08-05T15:20:08Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T15:20:08Z","sha256":"d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80","source":"amazon-inspector","versions":["35.9.5"],"id":"IN-MAL-2026-015658","import_time":"2026-08-05T16:13:29.091433642Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-card-gallery/v/35.9.5"}],"affected":[{"package":{"name":"dolyame-boxy-mobile-bnpl-card-gallery","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-mobile-bnpl-card-gallery"},"versions":["35.9.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"4e4b97d304c8be87763f0afc85ae4ddb62565a869f64bd35e0fb4fa4cb5e508a","tlsh":"12a1a75616aa70088b7097e4c7274415f56bf66337c0c694fbaca5985f7702883b2efc"},{"path":"lib/telemetry.js","sha256":"ad055b0a5a73c3a5771a167bff64bcc2a6ab31d8844c2764fb3802073fdc8c57","tlsh":"94835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-card-gallery-35.9.5.tgz","hashes":{"sha512_sri":"sha512-d8AAHVJpVCjkUI+xSH75hpa43G7su82lMvffgt48Sl4mBxgdk0Uk0xa4ZxVOir3lnos9a3/6JkwUCBe78GWERQ==","sha1":"9c406e71aeb48a218a55e8278d530865515e60b9"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-card-gallery/MAL-2026-13338.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}