registry / dolyame-boxy-desktop-bnpl-hero-title / 35.4.2

dolyame-boxy-desktop-bnpl-hero-title@35.4.2

Lightweight dolyame boxy desktop bnpl hero title wrapper

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically runs a hidden remote payload loader. It fetches a binary over HTTPS or DNS TXT, writes it to a temporary directory, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Unconsented arbitrary native code execution under the consuming application's user account.

Mechanism

Remote binary download, temporary drop, chmod, and detached process execution.

Attack narrative

When an application imports the advertised wrapper, index.js silently requires _helpers.js. The helper selects a platform-specific endpoint, downloads a payload from obfuscated workers.dev hosts or reconstructs one from DNS TXT records, then writes it into a temporary directory. On Unix it marks the file executable and invokes it through a detached shell; on Windows it starts the executable detached. This is unrelated to the package's stated title-wrapper functionality.

Rationale

The entrypoint-triggered loader provides a concrete remote code execution chain with no user action beyond importing the package. Its hidden network endpoints, temporary binary drop, and detached execution are malicious behavior.

Evidence

package.jsonindex.js_helpers.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints7

On require of the package, _helpers.js reassembles hostnames from split string arrays (e.g. 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev') and downloads a platform-specific native binary over HTTPS, with a DNS-TXT covert-channel fallback under *.dl.wel1.ru that base64-decodes concatenated TXT record chunks into the payload bytes. The downloaded binary is written to a temp path under a disguised name (dotnet_diag_<uid>.exe on Windows,.cache_<uid> on Unix), chmodded 0755, and spawned detached via spawn('/bin/sh','-c', filePath + ' &') or spawn('cmd',...). No hash or signature verification is performed and the delivery hosts are author-mutable. A second module, lib/telemetry.js, is bundled as a purported 'analytics' component and contains the same download-chmod-spawn shape (HTTPS transport, DNS service discovery, chmod 755 via string-concatenated 'chmod'+'Sync', spawn /bin/sh -c '<file> &'); it is not referenced from index.js in this version but ships in the tarball. Hostname string-splitting and the DNS-TXT fallback channel indicate deliberate evasion of static scanners and network filters. The package name and version metadata do not correspond to a documented native component that would justify runtime binary delivery.

dolyame-boxy-desktop-bnpl-hero-title@35.4.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code