dolyame-boxy-mobile-bnpl-header

{"modified":"2026-08-05T15:21:27Z","published":"2026-08-05T15:21:27Z","schema_version":"1.7.4","id":"MAL-2026-13341","summary":"Malicious code in dolyame-boxy-mobile-bnpl-header (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0)\nOn require of the package, _shim.js assembles remote hostnames at runtime by joining split string fragments (four Cloudflare Workers subdomains such as oob-worker.cf101-adf.workers.dev / cf103-070 / cf102-baf / cf99-9b3, with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with unref(). Execution is gated behind a lock file and DO_NOT_TRACK/ANALYTICS_OPT_OUT environment variables framed as telemetry opt-outs. The runtime-reconstructed destinations, disguised filenames, and detached background execution demonstrate deliberate concealment. Nothing in the package's stated 'device integration / BNPL header' purpose justifies fetching and executing an opaque binary from anonymous Cloudflare Workers hosts on module load.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-mobile-bnpl-header"},"versions":["35.3.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"ea8ac82243fa4f7b1bed4217b5634dd516e1ecfd42e1fbea75377f9c68a783e5","tlsh":"24a1865a12aa701d4bb0d7e4c7174416f65af6633380c198fb5ca9981fb712482b1efc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-header-35.3.6.tgz","hashes":{"sha1":"64c85a8681da35dc3131862ecc7a95a39eb27a7a","sha512_sri":"sha512-TloBVhwsCQE49qFjF7hVGov03zuh6L/5ybq370eq/pUChTfyZy4GCDXUmANAhpzfFwJ8rKyL4NM5gRpdHb3ngA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-header/v/35.3.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015666","import_time":"2026-08-05T16:13:29.922628426Z","modified_time":"2026-08-05T15:21:27Z","sha256":"405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0","source":"amazon-inspector","versions":["35.3.6"]}]}}