{"id":"MAL-2026-13341","summary":"Malicious code in dolyame-boxy-mobile-bnpl-header (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0)\nOn require of the package, _shim.js assembles remote hostnames at runtime by joining split string fragments (four Cloudflare Workers subdomains such as oob-worker.cf101-adf.workers.dev / cf103-070 / cf102-baf / cf99-9b3, with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with unref(). Execution is gated behind a lock file and DO_NOT_TRACK/ANALYTICS_OPT_OUT environment variables framed as telemetry opt-outs. The runtime-reconstructed destinations, disguised filenames, and detached background execution demonstrate deliberate concealment. Nothing in the package's stated 'device integration / BNPL header' purpose justifies fetching and executing an opaque binary from anonymous Cloudflare Workers hosts on module load.\n","modified":"2026-08-05T16:51:01.281096675Z","published":"2026-08-05T15:21:27Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015666","import_time":"2026-08-05T16:13:29.922628426Z","modified_time":"2026-08-05T15:21:27Z","sha256":"405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0","source":"amazon-inspector","versions":["35.3.6"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-header/v/35.3.6"}],"affected":[{"package":{"name":"dolyame-boxy-mobile-bnpl-header","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-mobile-bnpl-header"},"versions":["35.3.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-header/MAL-2026-13341.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-TloBVhwsCQE49qFjF7hVGov03zuh6L/5ybq370eq/pUChTfyZy4GCDXUmANAhpzfFwJ8rKyL4NM5gRpdHb3ngA==","sha1":"64c85a8681da35dc3131862ecc7a95a39eb27a7a"},"filename":"dolyame-boxy-mobile-bnpl-header-35.3.6.tgz"}],"evidence_files":[{"sha256":"ea8ac82243fa4f7b1bed4217b5634dd516e1ecfd42e1fbea75377f9c68a783e5","tlsh":"24a1865a12aa701d4bb0d7e4c7174416f65af6633380c198fb5ca9981fb712482b1efc","path":"_shim.js"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}