dolyame-boxy-independent-bnpl-tiles

{"modified":"2026-08-05T15:20:17Z","published":"2026-08-05T15:20:17Z","schema_version":"1.7.4","id":"MAL-2026-13333","summary":"Malicious code in dolyame-boxy-independent-bnpl-tiles (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5)\nOn require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and joining them (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), fetches an opaque platform-specific binary over HTTPS from those hosts, writes it to a disguised temp path (names like.cache_* and dotnet_diag_*.exe), sets the executable bit via fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}) (with a cmd branch for Windows). A base64-over-DNS-TXT fallback channel is implemented against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reading a chunk count from c.<domain> and reassembling base64 TXT chunks into the payload. No native source is shipped that would justify a binary download, and the destinations are unrelated to any declared publisher. A second module lib/telemetry.js is not reached from main in this version but contains the same fetch/chmod/spawn dropper pattern.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-independent-bnpl-tiles"},"versions":["35.7.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"175dfe6c9daa4307e94ec71392386879cbd0636c40f21a4a2b04e2e19250ac56","tlsh":"d3a1b7aa11aa701987b0d7f48717680af65bf6733781c2d8f65c95980f7612483b2efc"},{"path":"lib/telemetry.js","sha256":"4eb97694d88291fad6ca90e795f5feca54b741cd828afc06090b73c441c4423b","tlsh":"bf835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-boxy-independent-bnpl-tiles-35.7.4.tgz","hashes":{"sha1":"acf5488e09ebbd77079aa526dffa075bb44ec3c2","sha512_sri":"sha512-Dl85vwrHtJ4v5bok9LnJt8iPGgHrAucXeV5YwEQbUAVsqAIchYdcIRLUp2ySGB4MtmEN1JufZr0JgdVL6FwiLg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-independent-bnpl-tiles/v/35.7.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015659","import_time":"2026-08-05T16:13:29.216399566Z","modified_time":"2026-08-05T15:20:17Z","sha256":"4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5","source":"amazon-inspector","versions":["35.7.4"]}]}}