registry / dolyame-boxy-atom-bnpl-button / 35.8.3

dolyame-boxy-atom-bnpl-button@35.8.3

Dolyame boxy atom bnpl button provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Requiring the package immediately starts an asynchronous remote-payload loader. It downloads an opaque platform-specific binary, writes it under a temporary path, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer imports/requires the package.

Impact

Arbitrary code execution as the importing process user.

Mechanism

Import-time remote binary download and detached execution.

Attack narrative

The public entrypoint suppresses errors while importing _helpers.js. That module contacts hard-coded remote hosts for an opaque platform payload, falls back to DNS TXT chunking, saves any payload over 1000 bytes to a temporary executable file, and starts it detached via cmd.exe or /bin/sh. This is concrete, unconsented import-time remote code execution.

Rationale

The package has no install hook, but normal import triggers a stealthy downloader-executor. The remote payload is neither authenticated nor package-aligned.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/package

On require, index.js loads _helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join (oob-worker.cf*.workers.dev) with a DNS-TXT chunked-base64 fallback channel to *.dl.wel1.ru, writes the bytes to /tmp/.cache_<rnd> or %TEMP%/dotnet_diag_<rnd>.exe, chmods 0755, and spawns the file detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}) or cmd equivalent on Windows. No integrity or signature check is performed on the fetched bytes. Destination hostnames are string-split to evade static detection, and file/lock names (analytics_state, dotnet_diag_*.exe,.cache_*) plus code comments framing the spawn as 'Detached process to avoid blocking npm install' present the behavior as telemetry. A lockfile with a ~22000s max age throttles re-fetching into a scheduled beacon pattern. The DNS-TXT channel provides a covert payload path when HTTPS egress is blocked. Any installer requiring this package executes attacker-controlled arbitrary code on their host.

dolyame-boxy-atom-bnpl-button@35.8.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code