registry / dolyame-boxy-independent-bnpl-swagger / 35.6.8

dolyame-boxy-independent-bnpl-swagger@35.6.8

Pluggable dolyame boxy independent bnpl swagger interface

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the advertised package entrypoint silently starts a remote binary download-and-execute chain. The payload is fetched over HTTPS or DNS TXT, staged in a temporary directory, and detached as a process.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any application requiring index.js

Impact

Arbitrary attacker-controlled native code can run under the importing user's account.

Mechanism

remote payload download, staging, and detached execution

Attack narrative

A normal require of index.js suppresses errors while loading setup.js. That module selects a platform-specific executable, fetches it from rotating hosts or DNS TXT records, writes it to a temp path, marks it executable on Unix, and starts it detached through a shell or cmd.exe. This is an unconsented remote-code-execution chain, not telemetry.

Rationale

The malicious behavior is source-confirmed and reachable on ordinary import, despite no install lifecycle hook. The large telemetry module reinforces the same staged executable pattern.

Evidence

package.jsonindex.jssetup.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf99-9b3.workers.dev

dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from array-fragment string joins (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) to defeat literal-string scanning, downloads a per-platform binary payload, writes it to /tmp as a hidden dotfile on Unix or to the Windows temp directory as dotnet_diag_*.exe, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe. When HTTPS delivery fails, it falls back to a DNS TXT covert channel against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru: it reads a record count from c.<domain> and reassembles base64-encoded binary bytes from numbered TXT records. The fetched code is unpinned, unsigned, and unrelated to the package's declared BNPL swagger purpose. A separate lib/telemetry.js bundles the same drop-and-exec primitives (fs["chmod"+"Sync"], cp.spawn("/bin/sh", ["-c", filePath+" &"])) using bracket-string reconstruction; it is not reachable from the current main entrypoint but is staged in the tarball.

dolyame-boxy-independent-bnpl-swagger@35.6.8

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code