registry / dolyame-boxy-independent-bnpl-partners / 35.9.3

dolyame-boxy-independent-bnpl-partners@35.9.3

Cross-service dolyame boxy independent bnpl partners adapter

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a hidden platform loader. It retrieves an opaque binary, drops it in a temp directory, then executes it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

require/import of the package entrypoint

Impact

Arbitrary native code executes under the importing process user.

Mechanism

remote binary download/DNS payload retrieval and detached execution

Attack narrative

The public entrypoint silently requires _platform.js. At import time it downloads a platform-specific binary from concealed HTTPS hosts or reconstructs one from DNS TXT records, writes it to a temporary path, marks it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is a concrete remote-code-execution loader.

Rationale

The behavior is import-time, concealed, and executes attacker-controlled remote bytes without user action. Lack of npm lifecycle hooks does not mitigate the reachable loader.

Evidence

package.jsonindex.js_platform.jslib/telemetry.js

Network endpoints8

oob-worker.cf103-070.workers.devoob-worker.cf99-9b3.workers.devoob-worker.cf102-baf.workers.devoob-worker.cf101-adf.workers.devsdk.dl.wel1.ru

On require of the package, index.js loads _platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation (oob-worker.*.workers.dev variants and sdk/ext/pkg/net.dl.wel1.ru), fetches a platform-specific binary over HTTPS with a DNS-TXT base64 fallback channel, writes it to /var/tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Cover-story identifiers such as analytics_state and a DISABLE_TELEMETRY opt-out are used to frame the behavior as telemetry. The package name impersonates a Russian BNPL partner integration, and none of the shipped code implements that stated purpose. ## Source: ghsa-malware (d48aace5fa5e8401a0a067c1eef992fb95425f9aca20add86d6c0214a530b412) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

dolyame-boxy-independent-bnpl-partners@35.9.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code