dolyame-boxy-atom-bnpl-navigation-arrow

{"modified":"2026-08-07T12:25:42Z","published":"2026-08-07T12:25:42Z","schema_version":"1.7.4","id":"MAL-2026-13550","summary":"Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0)\nOn require() of the package, index.js loads _bridge.js which unconditionally executes a setup routine that downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime by joining split string fragments. The bytes are written to /var/tmp or %TEMP% under names mimicking legitimate artifacts (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod 0755'd, and launched detached via /bin/sh -c \"<path> &\" or cmd.exe /c start. When the HTTPS mirrors fail, _bridge.js falls back to a DNS-TXT covert channel: it queries TXT records at c.<domain> against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru to learn a chunk count, then retrieves the payload in numbered TXT records and base64-decodes the concatenation before writing and executing it through the same sink. The child_process module name is itself split (\"child_\"+\"process\") to evade static matching, and execution is gated by a ~19958-second cooldown plus DISABLE_TELEMETRY / DO_NOT_TRACK checks used as cover. Package name and version pattern are consistent with a typosquat / dependency-confusion lure.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-atom-bnpl-navigation-arrow"},"versions":["35.6.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"d9b56186e7c6af6232a77b52ababedd83353a21a4ec3d0edfd7eb21c235d7b23","tlsh":"eba198aa116670084b70dbe4c7175416f65af2637380c298fb9ca9980fb352482f2ffc"}],"package_integrity":[{"filename":"dolyame-boxy-atom-bnpl-navigation-arrow-35.6.5.tgz","hashes":{"sha1":"ade75b7d318632c824b61df77db8ba28b0da58f4","sha512_sri":"sha512-F5m/Lyp2l8+N2u2ucckjB2X+8/x3ZoMQxCZMhBUZSKcf7hRZCK7gK+XPF5RzR8kVb5bsRZaDDVnzKRWhIDnrjA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-atom-bnpl-navigation-arrow/v/35.6.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016976","import_time":"2026-08-07T12:51:20.58323679Z","modified_time":"2026-08-07T12:25:42Z","sha256":"7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0","source":"amazon-inspector","versions":["35.6.5"]}]}}