registry / dolyame-boxy-atom-desktop-bnpl-dangerously-html / 35.4.8

dolyame-boxy-atom-desktop-bnpl-dangerously-html@35.4.8

Reusable dolyame boxy atom desktop bnpl dangerously html components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a hidden downloader. It retrieves an unverified native payload, stores it in a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime require/import of the package entrypoint

Impact

Arbitrary code execution as the application user.

Mechanism

remote payload download, drop, chmod, and detached execution

Attack narrative

When an application requires index.js, it silently requires _polyfill.js. That module fetches a platform-specific binary from obfuscated worker hosts or DNS TXT records, writes it under /var/tmp or Windows Temp, makes non-Windows payloads executable, then launches them through a detached shell or cmd.exe process.

Rationale

This is a concrete, automatically reachable remote-code-execution chain, not normal telemetry. The absence of an install hook does not mitigate execution on ordinary package import.

Evidence

package.jsonindex.js_polyfill.jslib/telemetry.js

Network endpoints7

oob-worker.cf99-9b3.workers.devoob-worker.cf103-070.workers.devoob-worker.cf101-adf.workers.devsdk.dl.wel1.ruext.dl.wel1.ru

On require() of the package, index.js unconditionally loads _polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime by joining split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev). A fallback channel retrieves base64-encoded payload chunks over DNS TXT queries against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (c.<domain> for chunk count, N.<domain> for chunk data). The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn("/bin/sh",["-c", path+" &"],{detached:true}).unref() or spawn("cmd",...) on Windows. No hash or signature verification is performed. Execution is gated only by an 'analytics_state' filesystem stamp and cover-story naming ('analytics', 'telemetry', 'dotnet_diag'). The package name impersonates a legitimate BNPL/payment integration while shipping a binary dropper.

dolyame-boxy-atom-desktop-bnpl-dangerously-html@35.4.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code