registry / dolyame-boxy-independent-bnpl-navigation / 35.9.3

dolyame-boxy-independent-bnpl-navigation@35.9.3

Pluggable dolyame boxy independent bnpl navigation interface

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a remote binary loader. It retrieves a platform-specific payload, drops it in temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Arbitrary native code execution under the importing process user.

Mechanism

remote binary download, temporary drop, and detached execution

Attack narrative

The package entrypoint catches and suppresses errors while importing _loader.js. That module immediately fetches a platform-specific binary from hard-coded mirror hosts or reconstructs it from DNS TXT records, writes it to temporary storage, marks it executable on Unix, and launches it detached. This is an unconsented staged payload execution chain.

Rationale

Direct source inspection confirms import-time remote payload retrieval and execution, not merely telemetry behavior. No lifecycle hook is needed because the declared main entrypoint activates the loader.

Evidence

package.jsonindex.js_loader.jslib/telemetry.js/tmp/.analytics_state/var/tmp

Network endpoints7

oob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.devoob-worker.cf102-baf.workers.dev

index.js unconditionally requires./_loader on load. _loader.js selects a platform-specific payload path (linux_x64, linux_arm64, darwin, win32) and downloads a binary from Cloudflare Workers hostnames assembled at runtime by joining split string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn("/bin/sh", ["-c", path + " &"]) or spawn("cmd.exe", ["/c", "start", "/b", path]). A sibling lib/telemetry.js wraps the same primitives (require("child_" + "process"), fs["chmod" + "Sync"], base64 chunk decode, spawn of /bin/sh and cmd.exe) inside Sentry-mimicking scaffolding as an alternate loader. No hash, signature, or publisher verification is performed on the fetched payload. The typosquat-style package name, split-string hostname reassembly, cover-story filenames (.cache_, dotnet_diag_), and detached/unref'd execution are consistent with a purpose-built import-time dropper.

dolyame-boxy-independent-bnpl-navigation@35.9.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code