dolyame-boxy-independent-bnpl-separator

{"modified":"2026-08-05T15:20:00Z","published":"2026-08-05T15:20:00Z","schema_version":"1.7.4","id":"MAL-2026-13329","summary":"Malicious code in dolyame-boxy-independent-bnpl-separator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46)\nOn load, index.js unconditionally requires _platform.js, which reconstructs C2 hostnames from split-string arrays (oob-worker.cf*.workers.dev with fallbacks to sdk.dl.wel1.ru, pkg.dl.wel1.ru, ext.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows impersonating Microsoft diagnostic tooling), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. A.analytics_state marker gates re-execution. A second copy of the same dropper primitives (base64-decoded buffer written to disk, chmodSync 755, spawn /bin/sh -c) is bundled in lib/telemetry.js behind a 'tracing.node' cover story. The package name presents as a BNPL/payment integration library but the shipped code is a cross-platform binary dropper with obfuscated infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-independent-bnpl-separator"},"versions":["35.2.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"e89922c9f012153321abd9c049686155d011c54a85ad8e34c6d51996b0179753","tlsh":"84a1855a12a6700887b097e587275416f66bf6637780c3c4f6ac95980f7213883b3efc"},{"path":"lib/telemetry.js","sha256":"6710502ba49034ad405577c17bb3ba0575b4e0929579667779690500f0c26003","tlsh":"69835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-boxy-independent-bnpl-separator-35.2.6.tgz","hashes":{"sha1":"5686567f6291ff936eaeab530d9d536d6a1c1734","sha512_sri":"sha512-ABFj1uy5nvPQMgcIqr8zJ5nSlFWVyfRRnSEyKjRPN1vcSJPjuYIph81ljKmg20enTP3eq1ijvVKmjm2SL532Rw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-independent-bnpl-separator/v/35.2.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015657","import_time":"2026-08-05T16:13:28.976748641Z","modified_time":"2026-08-05T15:20:00Z","sha256":"273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46","source":"amazon-inspector","versions":["35.2.6"]}]}}