registry / dolyame-boxy-independent-bnpl-main-banner / 35.2.1

dolyame-boxy-independent-bnpl-main-banner@35.2.1

Dolyame boxy independent bnpl main banner abstraction layer

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently activates a remote payload downloader. It fetches or DNS-reconstructs a binary, drops it into a temporary directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Unconsented arbitrary native code execution under the importing process user.

Mechanism

Remote binary download, temporary-file drop, and detached execution.

Attack narrative

The advertised module imports _bridge.js unconditionally. That bridge chooses platform-specific binary paths, attempts several obfuscated HTTPS hosts, then uses DNS TXT records as a fallback payload channel. If it obtains sufficient bytes, it writes a randomly named executable to a temp directory, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe.

Rationale

This is an import-time remote payload execution chain unrelated to the declared banner abstraction. No install hook is needed because ordinary package use triggers it.

Evidence

index.js_bridge.jspackage.jsonlib/telemetry.js

Network endpoints8

oob-worker.cf101-adf.workers.devoob-worker.cf102-baf.workers.devoob-worker.cf100-416.workers.devoob-worker.cf103-070.workers.dev

index.js unconditionally requires./_bridge on load. _bridge.js selects a per-platform payload (linux x64/arm64, darwin, win32), fetches a native binary over HTTPS from a hardcoded list of Cloudflare *.workers.dev endpoints (assembled at runtime by joining split string arrays such as ["oob-worker.cf101-adf.work","ers",".de","v"]), writes it to /tmp/.cache_<uid> or %TEMP%/dotnet_diag_<uid>.exe under names that impersonate benign artifacts, chmods 0755 on POSIX via fs["chmod"+"Sync"], and spawns it detached through /bin/sh -c on POSIX or cmd.exe /c start /b on Windows. A DNS TXT covert-channel fallback resolves alternate payload sources under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, with the discovery domains also reconstructed from split arrays. lib/telemetry.js ships a second parallel dropper implementation labelled as an "Analytics SDK" (base64 payload assembly, chmodSync 0755, /bin/sh -c spawn) that is not reached from the current index.js but is packaged in the tarball. The advertised purpose (a BNPL banner abstraction) has no relationship to fetching and executing platform-specific native executables, and the destinations are not publisher-owned.

dolyame-boxy-independent-bnpl-main-banner@35.2.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code