dolyame-boxy-independent-bnpl-origination@35.6.6

OSV Malicious Advisory

scanned 10d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13323 confirms this npm version as malicious. On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g. "oob-worker.cf99-9b3.worker" + "s.dev"), downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev) with a DNS-TXT covert-channel fallback (base64 chunks reassembled from resolveTxt of numeric subdomains...

Advisory

MAL-2026-13323

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in dolyame-boxy-independent-bnpl-origination (npm)

Details

On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g. "oob-worker.cf99-9b3.worker" + "s.dev"), downloads an opaque binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev) with a DNS-TXT covert-channel fallback (base64 chunks reassembled from resolveTxt of numeric subdomains under dl.wel1.ru), writes the payload to a disguised path under /tmp or %TEMP% (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755 on Unix, and spawns it detached via /bin/sh or cmd.exe. A state file throttles re-runs. Package name resembles a legitimate BNPL/payment integration but the shipped code implements a remote-payload dropper with no relation to that stated purpose.

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory PACKAGE

Decision evidence

Source & flagged code

3 flagged

_ext.jsView file

6const path = require("path"); L7: const https = require("https"); L8: ... L45: const MAX_AGE = 20276; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_ext.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> index.js -> _ext.js L6: const path = require("path"); L7: const https = require("https"); L8: ... L45: const MAX_AGE = 20276; L46: const _l = (...a) => process.stderr.write(""); L47: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L91: try { L92: require("dns").resolveTxt(d, (e, rr) => { L93: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_ext.jsView on unpkg · L6

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_ext.jsView on unpkg · L120