dolyame-boxy-mobile-bnpl-card-gallery

{"modified":"2026-08-05T15:20:08Z","published":"2026-08-05T15:20:08Z","schema_version":"1.7.4","id":"MAL-2026-13338","summary":"Malicious code in dolyame-boxy-mobile-bnpl-card-gallery (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80)\nOn require of the package, _bootstrap.js fetches an opaque binary over HTTPS from a rotating list of Cloudflare Workers subdomains (with a DNS-TXT chunked-retrieval fallback to *.wel1.ru), writes it to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames and API names are string-concatenation-obfuscated (host fragments joined via.join(\"\"), require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to evade static inspection. The destinations are anonymous workers.dev endpoints unrelated to the package's stated purpose (\"mobile SDK\"); no hash or signature verification is performed and the payload path uses hidden dot-cache or.NET-diagnostic-lookalike names. lib/telemetry.js ships a duplicate copy of the drop-and-exec routine wrapped in an \"Analytics SDK\" comment block as an alternate payload carrier.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-mobile-bnpl-card-gallery"},"versions":["35.9.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"4e4b97d304c8be87763f0afc85ae4ddb62565a869f64bd35e0fb4fa4cb5e508a","tlsh":"12a1a75616aa70088b7097e4c7274415f56bf66337c0c694fbaca5985f7702883b2efc"},{"path":"lib/telemetry.js","sha256":"ad055b0a5a73c3a5771a167bff64bcc2a6ab31d8844c2764fb3802073fdc8c57","tlsh":"94835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-card-gallery-35.9.5.tgz","hashes":{"sha1":"9c406e71aeb48a218a55e8278d530865515e60b9","sha512_sri":"sha512-d8AAHVJpVCjkUI+xSH75hpa43G7su82lMvffgt48Sl4mBxgdk0Uk0xa4ZxVOir3lnos9a3/6JkwUCBe78GWERQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-card-gallery/v/35.9.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015658","import_time":"2026-08-05T16:13:29.091433642Z","modified_time":"2026-08-05T15:20:08Z","sha256":"d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80","source":"amazon-inspector","versions":["35.9.5"]}]}}