registry / dolyame-boxy-desktop-bnpl-card-gallery / 35.5.2

dolyame-boxy-desktop-bnpl-card-gallery@35.5.2

Dolyame boxy desktop bnpl card gallery abstraction layer

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately triggers a background downloader. It retrieves a platform-specific binary, writes it to temporary storage, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime require/import of index.js

Impact

Arbitrary native code executes with the importing user's privileges.

Mechanism

Remote binary download, drop, chmod, and detached execution

Attack narrative

When index.js is imported, it silently requires _bridge.js. That module fetches a platform-specific payload from obfuscated worker hosts, or reconstructs one from DNS TXT records. It saves the payload under a randomized temporary filename, adds execute permission on Unix, and launches it through a detached shell or cmd.exe process. lib/telemetry.js contains the same configurable download-and-execute primitive.

Rationale

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of lifecycle scripts does not mitigate execution on normal import.

Evidence

package.jsonindex.js_bridge.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf103-070.workers.dev

On require() of this package, index.js loads _bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that reassembles a base64-encoded payload from TXT records. The fetched bytes are written under /tmp or %TEMP% with a disguised filename (`.cache_<hex>` or `dotnet_diag_<hex>.exe`), chmodded 0755, and spawned detached via `/bin/sh -c` or `cmd.exe`. The C2 host strings and the `child_process` module name are split across array joins (`["oob-worker.cf103-070.wo","rk","ers",".de","v"].join("")`, `require("child_"+"process")`) to evade static matching. Cover-story identifiers (`analytics_state`, `DISABLE_TELEMETRY`) frame the drop as telemetry. A second, structurally identical dropper ships in lib/telemetry.js (~81 KB) dressed as an analytics SDK: dynamic `require("child_"+"process")`, base64 buffer reassembly, `chmodSync(..., 0o755)`, and `cp.spawn("/bin/sh", ["-c", filePath+" &"],...)`.

dolyame-boxy-desktop-bnpl-card-gallery@35.5.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code