registry / dolyame-boxy-atom-bnpl-card / 35.5.5

dolyame-boxy-atom-bnpl-card@35.5.5

Shared dolyame boxy atom bnpl card library for backend integration

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically retrieves and runs an opaque platform-specific executable. The payload source can be changed remotely and is launched detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package's main entrypoint.

Impact

Arbitrary native code execution under the importing application's user account.

Mechanism

Import-time remote binary download, drop, and detached execution.

Attack narrative

Loading index.js silently requires _adapter.js. Its setup routine selects a platform payload, obtains it from rotating remote hosts or DNS TXT records, writes it to a temp directory, marks Unix payloads executable, and starts it detached through /bin/sh or cmd.exe.

Rationale

This is a concrete import-time staged-payload chain with remote native-code execution, unrelated to the advertised library API. Absence of an npm lifecycle hook does not mitigate execution on normal package use.

Evidence

package.jsonindex.js_adapter.js/tmp/.analytics_state/var/tmp/.cache_<random>Windows temp/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.devoob-worker.cf100-416.workers.devoob-worker.cf103-070.workers.dev

On require of the package, index.js loads _adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via array-join concatenation (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a fallback that reassembles the executable from base64 chunks retrieved over DNS TXT records at c.dl.wel1.ru, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names (dotnet_diag_*.exe,.cache_*), chmodded to 0755 via a string-split fs['chmod'+'Sync'] call, and executed detached via spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true}).unref() or a cmd equivalent on Windows. A ~24h marker file suppresses re-execution. A sibling lib/telemetry.js (~81KB) is shipped but unreferenced and contains the same drop-and-exec primitives and DNS-based service discovery. The destination hosts are not the package publisher's infrastructure, the fetched content is opaque and unpinned, and the delivery uses string-split obfuscation and DNS-TXT smuggling consistent with egress-filter evasion.

dolyame-boxy-atom-bnpl-card@35.5.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code