registry / dolyame-boxy-atom-bnpl-dangerously-html / 35.5.4

dolyame-boxy-atom-bnpl-dangerously-html@35.5.4

Dolyame boxy atom bnpl dangerously html abstraction layer

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote binary loader. It retrieves a platform-specific payload over HTTPS or DNS, writes it to a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js require/import of the package entrypoint.

Impact

Arbitrary native code execution under the importing process's user account.

Mechanism

Import-time remote binary download and detached execution.

Attack narrative

The package entrypoint catches and suppresses errors while requiring _loader.js. That loader uses obfuscated host strings, downloads a binary tailored to the OS/architecture from rotating HTTPS mirrors or reconstructs one from DNS TXT records, saves it in a temporary directory, grants Unix execute permission, and starts it via a detached shell or cmd.exe process. A short-lived marker suppresses repeat downloads and environment variables offer misleading telemetry-style opt-out names.

Rationale

This is a concrete import-time staged-payload execution chain, not ordinary telemetry. The loader silently executes attacker-hosted native code without user consent.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

On require of the package, index.js loads _loader.js which reconstructs attacker-controlled hostnames via string-split.join('') to evade scanners (mirrors of the form oob-worker.cf10{0,1,2}-{baf,adf}.workers.dev and DNS TXT fallback domains under wel1.ru such as sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), selects a platform/arch-specific asset, downloads a binary from one of the anonymous Cloudflare Workers hosts (with a DNS-over-TXT fallback that base64-reassembles bytes from <n>.<domain> TXT records), writes it to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawns it detached via /bin/sh -c or cmd.exe. A marker file named.analytics_state and comments referring to 'opt-out environment variables' present a telemetry cover story. There is no hash or signature verification on the downloaded bytes, the destinations are anonymous hosts unrelated to any legitimate publisher, and the package name itself is a lookalike combining unrelated brand/technology tokens.

dolyame-boxy-atom-bnpl-dangerously-html@35.5.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code