dolyame-boxy-mobile-bnpl-card-panel

{"modified":"2026-08-05T15:20:56Z","published":"2026-08-05T15:20:56Z","schema_version":"1.7.4","id":"MAL-2026-13339","summary":"Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218)\nOn require, _bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. When HTTPS mirrors fail, the code falls back to a DNS-TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it queries a c.<domain> TXT record for a chunk count, then retrieves base64 chunks from 0.<domain>..N-1.<domain>, concatenates, base64-decodes, and hands the bytes to the same write-chmod-spawn sink. Destination hostnames and DNS domains are assembled at runtime from fragmented string arrays (e.g. [\"oob-worker.cf103\",\"-070.worker\",\"s.de\",\"v\"].join(\"\")) to evade static matching. A TTL cache at /tmp/.analytics_state throttles re-execution; opt-out exists only via undocumented environment variables. Package presents itself as a payment/device integration library, but the traced load-time behavior is fetch-and-execute of opaque attacker-controlled binaries.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-mobile-bnpl-card-panel"},"versions":["35.3.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"a5609e581121c53d049077be740d56461f66232414ae06e9f03d07dfaecfacec","tlsh":"95b1a69a16a670194bb09be0c7178416fa5bf2633380d2c4fa5ca5940fb7124c3b2efc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-card-panel-35.3.4.tgz","hashes":{"sha1":"d7aae50feda90280cfc5c9f8e23076570f2f7b8f","sha512_sri":"sha512-Wti4GwK03TPxVr/wN6XOtj9y1e8KEYwd2ZTTKaAyZW0GlpREmKo9n5XWqKC+HjUUo+9vyuxuDgegpEeHpGTArQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-card-panel/v/35.3.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015663","import_time":"2026-08-05T16:13:29.641074924Z","modified_time":"2026-08-05T15:20:56Z","sha256":"81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218","source":"amazon-inspector","versions":["35.3.4"]}]}}