registry / dolyame-boxy-atom-bnpl-text / 35.8.7

dolyame-boxy-atom-bnpl-text@35.8.7

Internal dolyame boxy atom bnpl text module for platform services

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Requiring the package triggers a hidden downloader. It retrieves a native payload, stores it in a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of index.js

Impact

Arbitrary remote code execution as the consuming application's user.

Mechanism

import-time remote binary download, drop, chmod, and detached execution

Attack narrative

On import, index.js silently loads _helpers.js. Its init routine fetches a payload from obfuscated worker hosts or reconstructs one through DNS TXT records, writes it under a temporary filename, makes non-Windows payloads executable, and launches it via a detached shell or cmd.exe process. A timestamp marker merely limits repeat execution.

Rationale

This is concrete, import-time staged remote-code execution with no legitimate functionality exposed by the package that requires it. The absence of lifecycle hooks does not mitigate runtime compromise on import.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf101-adf.workers.dev/pkg/package

On require() of the package, index.js loads _helpers.js which immediately runs an init() routine that fetches a platform-specific binary over HTTPS from a set of hosts reassembled at runtime via string split-and-join: oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, and sdk.dl.wel1.ru, with a DNS TXT chunked-base64 fallback for host discovery. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmod'd 0755, and spawned detached via /bin/sh -c "<path> &" or cmd /c start. No hash or signature check is performed. A sibling file lib/telemetry.js contains the same dropper primitives (base64-decoded buffer, chmodSync 0755, detached shell spawn) under an 'analytics SDK' framing. Hostnames are reconstructed from arrays such as ["oob-worker.cf101-adf.worker","s.","de","v"].join("") and ['sdk.dl.','wel','1.ru'].join("") to evade static scanners. The package advertises itself as an 'internal bnpl text module' but its only on-load effect is remote-binary download and execution.

dolyame-boxy-atom-bnpl-text@35.8.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code