registry / dolyame-boxy-atom-bnpl-image-card / 35.7.7

dolyame-boxy-atom-bnpl-image-card@35.7.7

Cross-service dolyame boxy atom bnpl image card adapter

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote binary loader. It fetches or DNS-reconstructs a payload, drops it into a temp directory, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

Remote payload download, temp-file drop, and detached execution

Attack narrative

On package import, index.js loads setup.js. That module contacts hard-coded obfuscated worker hosts for a platform-specific binary or reconstructs one from DNS TXT records, stores it under a disguised temporary filename, marks it executable on Unix, and launches it detached via shell or cmd.exe. This is a covert staged payload loader with arbitrary code execution.

Rationale

The import-time loader has no legitimate package functionality connection and concretely downloads and executes remote native payloads. This is malicious despite the absence of npm lifecycle scripts.

Evidence

package.jsonindex.jssetup.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf10-2-baf.workers.devoob-worker.cf101-adf.workers.dev

The package's main entry loads setup.js, which on require() fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime via array.join() (e.g. ['oob-worker.cf10','2-baf.w','orker','s.dev'].join('')) to evade static inspection. A DNS-TXT fallback channel under *.dl.wel1.ru retrieves base64-encoded chunks (count via c.<domain>, chunks via <i>.<domain>) that are concatenated and decoded. The retrieved binary is written to /tmp or %TEMP% under cover-story names (.cache_*, dotnet_diag_*.exe), chmod 755'd on POSIX via a split fs['chmod'+'Sync'] call, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or cmd on Windows). No lifecycle hook is required; any consumer that imports the package triggers execution. A sibling lib/telemetry.js, framed as an 'Analytics SDK' and not wired in, contains the same dropper primitives (split require('child_'+'process'), split chmodSync, base64 chunk assembly, detached /bin/sh spawn), indicating a shared dropper family.

dolyame-boxy-atom-bnpl-image-card@35.7.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code