{"id":"MAL-2026-13339","summary":"Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218)\nOn require, _bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. When HTTPS mirrors fail, the code falls back to a DNS-TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it queries a c.\u003cdomain\u003e TXT record for a chunk count, then retrieves base64 chunks from 0.\u003cdomain\u003e..N-1.\u003cdomain\u003e, concatenates, base64-decodes, and hands the bytes to the same write-chmod-spawn sink. Destination hostnames and DNS domains are assembled at runtime from fragmented string arrays (e.g. [\"oob-worker.cf103\",\"-070.worker\",\"s.de\",\"v\"].join(\"\")) to evade static matching. A TTL cache at /tmp/.analytics_state throttles re-execution; opt-out exists only via undocumented environment variables. Package presents itself as a payment/device integration library, but the traced load-time behavior is fetch-and-execute of opaque attacker-controlled binaries.\n","modified":"2026-08-05T16:51:00.180131809Z","published":"2026-08-05T15:20:56Z","database_specific":{"malicious-packages-origins":[{"versions":["35.3.4"],"id":"IN-MAL-2026-015663","import_time":"2026-08-05T16:13:29.641074924Z","modified_time":"2026-08-05T15:20:56Z","sha256":"81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-card-panel/v/35.3.4"}],"affected":[{"package":{"name":"dolyame-boxy-mobile-bnpl-card-panel","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-mobile-bnpl-card-panel"},"versions":["35.3.4"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"95b1a69a16a670194bb09be0c7178416fa5bf2633380d2c4fa5ca5940fb7124c3b2efc","path":"_bootstrap.js","sha256":"a5609e581121c53d049077be740d56461f66232414ae06e9f03d07dfaecfacec"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-card-panel-35.3.4.tgz","hashes":{"sha1":"d7aae50feda90280cfc5c9f8e23076570f2f7b8f","sha512_sri":"sha512-Wti4GwK03TPxVr/wN6XOtj9y1e8KEYwd2ZTTKaAyZW0GlpREmKo9n5XWqKC+HjUUo+9vyuxuDgegpEeHpGTArQ=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-card-panel/MAL-2026-13339.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}