dolyame-boxy-mobile-bnpl-footer

{"modified":"2026-08-05T15:19:30Z","published":"2026-08-05T15:19:30Z","schema_version":"1.7.4","id":"MAL-2026-13340","summary":"Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb)\nThe package's main entry (index.js) requires./_compat, which at import time downloads a platform-specific executable from author-controlled endpoints assembled at runtime by joining string arrays: oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, and oob-worker.cf103-070.workers.dev. A fallback path reconstructs a base64 payload from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A per-platform download map selects /pkg/package (linux_x64), /pkg/loader_mac (darwin), or /pkg/package.exe (win32). The fetched bytes are written to a decoy path (/tmp/.cache_<hex> on Unix or TEMP/dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c '<file> &' or cmd.exe start /b. lib/telemetry.js ships a second copy of the same primitive under an SDK/telemetry cover story: child_process is acquired via require(\"child_\"+\"process\"), fs.chmodSync is called as fs[\"chmod\"+\"Sync\"], and the payload is reassembled with Buffer.from(chunks,\"base64\") before being spawned. Hostnames, function names, and dropped-file names are constructed at call time to evade static inspection, and the persisted file uses hidden dotfile / Windows diagnostic-tool decoy names (.cache_<hex>, dotnet_diag_<hex>.exe,.analytics_state). The package name presents as a payment/BNPL footer component, which does not match the observed behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-mobile-bnpl-footer"},"versions":["35.4.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"c8cb3b5f56b3f73fd599b9f39e1a3db695a7bdb4beae2d701ac33c5a32f51350","tlsh":"88a1959a16aa70198f70e7e0c7164816f66bf6633780c2c4fb5c54845f7222483b2efc"},{"path":"lib/telemetry.js","sha256":"2309b76c8cf8edac10e0c26f9ef0e5fd258075c58c4f418e05e6316ec5db7b81","tlsh":"5c835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-footer-35.4.7.tgz","hashes":{"sha1":"67edba48e29a12a1a524531f80cf9d64bf437525","sha512_sri":"sha512-dCWaxRpyh3xXwr5Y/njfVhtuYBsdaWTzMhQUX1wwgIz+11FbAj1mPm40UstTOSXSeBTmawuOxdc2lU5308zLXg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-footer/v/35.4.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015654","import_time":"2026-08-05T16:13:28.665839856Z","modified_time":"2026-08-05T15:19:30Z","sha256":"5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb","source":"amazon-inspector","versions":["35.4.7"]}]}}