registry / dolyame-boxy-independent-bnpl-info-slider / 35.1.9

dolyame-boxy-independent-bnpl-info-slider@35.1.9

Dolyame boxy independent bnpl info slider provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the advertised main entrypoint automatically triggers a remote payload fetch. A retrieved binary is dropped to a temporary path and executed detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import or require of index.js, unless telemetry opt-out environment variables are set or the temporary lock is fresh.

Impact

Arbitrary attacker-hosted native code executes with the importing process user's privileges.

Mechanism

import-time remote binary download, drop, and detached execution

Attack narrative

The public index imports _vendor.js as a hidden side effect. That module selects an OS-specific binary path, downloads payload bytes from obfuscated workers.dev hosts or DNS TXT records, saves them under a temporary disguised filename, marks Unix payloads executable, and launches them detached via /bin/sh or cmd.exe.

Rationale

This is concrete import-time staged remote-code execution unrelated to the claimed slider functionality. Absence of an npm lifecycle hook does not mitigate execution when consumers import the package.

Evidence

package.jsonindex.js_vendor.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf101-adf.workers.dev/pkg/package

On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked base64 fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under deceptive names such as dotnet_diag_*.exe and.cache_*, chmod 0755 on POSIX, then spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A second ~81 KB module at lib/telemetry.js, framed as an 'Analytics SDK', reimplements the same fetch/write/chmod/spawn chain and DNS-TXT reassembly as a redundant dropper. Hostnames and sensitive API identifiers ('child_process', 'chmodSync', 'workers.dev', 'dl.wel1.ru') are reconstructed at runtime via Array.join and bracket-property concatenation to evade static analysis. Opt-out environment variables and a TTL lock file are present as cover-story hygiene but do not constitute consent.

dolyame-boxy-independent-bnpl-info-slider@35.1.9

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code