registry / dolyame-boxy-desktop-bnpl-footer / 35.7.7

dolyame-boxy-desktop-bnpl-footer@35.7.7

Dolyame boxy desktop bnpl footer abstraction layer

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a hidden downloader. It retrieves an unverified platform binary and executes it detached from a temporary directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code execution as the importing user.

Mechanism

Remote binary download, DNS payload fallback, temp-file execution.

Attack narrative

When an application imports the advertised library, index.js silently requires _platform.js. That module fetches a platform-specific payload from concealed worker hosts, or reconstructs one from DNS TXT records, stores it in a temporary path, marks it executable on Unix, and launches it detached via a shell or cmd.exe. The payload is neither authenticated nor inspected.

Rationale

The public import path directly reaches unverified remote binary execution, unrelated to the package’s stated footer abstraction. This is concrete malware behavior, not ordinary telemetry.

Evidence

package.jsonindex.js_platform.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf102-baf.workers.devoob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.dev

Requiring dolyame-boxy-desktop-bnpl-footer causes _platform.js to execute at load time: it reconstructs destination hostnames from split string arrays (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev), downloads a platform-specific binary, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows (masquerading as a.NET diagnostic file), chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. If HTTPS delivery fails, dnsChunked() falls back to a DNS-TXT covert channel under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru), resolving c.<domain> for a chunk count and reassembling base64 TXT records into the executable. Destinations and dangerous APIs are obfuscated via Array.join('') and dynamic property lookups (require('child_'+'process'), fs['chmod'+'Sync']). A second copy of the same dropper is bundled in lib/telemetry.js behind an 'Analytics SDK' cover story. No hash or signature verification is performed on the fetched binary.

dolyame-boxy-desktop-bnpl-footer@35.7.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code