registry / dolyame-boxy-atom-bnpl-badge / 35.2.3

dolyame-boxy-atom-bnpl-badge@35.2.3

Dolyame boxy atom bnpl badge runtime support module

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically retrieves and launches an untrusted native payload. It falls back to DNS-delivered bytes if HTTPS fails.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of the package entrypoint.

Impact

Arbitrary code executes with the importing process's privileges.

Mechanism

remote binary download, temporary-file drop, and detached execution

Attack narrative

The public entrypoint silently loads _helpers.js. Its immediate start() call contacts obfuscated worker hosts for an OS-specific payload, falls back to chunked DNS TXT retrieval, saves the bytes under a disguised temporary filename, marks Unix files executable, and launches them detached through a shell or cmd.exe. This is unconsented runtime remote-code execution.

Rationale

Direct source inspection confirms an automatically triggered remote payload downloader and executor. This is concrete malicious behavior, not ordinary telemetry.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf103-070.workers.dev/pkg/package

On require() of dolyame-boxy-atom-bnpl-badge, _helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors (oob-worker.cf100-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-*.workers.dev, oob-worker.cf199-*.workers.dev) with a DNS-TXT chunked fallback through sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Destination hostnames and API names are assembled via array-join fragments (e.g. ['oob-worker.cf103-070.wo','rkers','.dev'].join(''); require('child_'+'process'); 'chmod'+'Sync') to evade static matching. The downloaded bytes are written to a disguised path in /tmp or %TEMP% as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755 on POSIX, then spawned detached with stdio ignored via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true,stdio:'ignore'}).unref(). No hash or signature verification. Execution is gated by a.analytics_state marker file and by env vars named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK to impersonate a telemetry opt-out. The dropper is unrelated to the package's stated BNPL-badge purpose. A sibling lib/telemetry.js frames the chain as analytics as a cover story.

dolyame-boxy-atom-bnpl-badge@35.2.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code