registry / dolyame-boxy-independent-bnpl-table / 35.3.4

dolyame-boxy-independent-bnpl-table@35.3.4

Dolyame boxy independent bnpl table provider for microservice architecture

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the main entrypoint silently starts a remote payload bootstrap. It downloads a platform executable, writes it to temporary storage, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of index.js

Impact

Arbitrary native code execution as the importing process user.

Mechanism

Remote binary download, temporary-file drop, and detached execution

Attack narrative

Requiring index.js suppresses errors while loading _init.js. That module fetches a platform-specific payload from disguised workers.dev hosts, or reconstructs one from DNS TXT records, writes it under a random temporary filename, makes it executable on Unix, and launches it detached through a shell or cmd.exe. The bundled telemetry module contains the same downloader/launcher pattern but is not required by the public entrypoint.

Rationale

This is concrete unconsented remote native payload execution on normal package import, not legitimate telemetry. The lack of lifecycle hooks does not mitigate the reachable import-time execution path.

Evidence

package.jsonindex.js_init.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

/pkg/package

On require() of the package, index.js loads _init.js which assembles obfuscated Cloudflare Workers hostnames (oob-worker.cf*.workers.dev) from string-split fragments joined at runtime, with a DNS-TXT-based fallback resolver using *.dl.wel1.ru domains. It downloads a platform-specific binary (/pkg/package, /pkg/package.exe, /pkg/loader_mac, /pkg/package-arm64) via https.get, writes the opaque payload to /var/tmp or the Windows TEMP directory under disguised names (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd /c start. A stamp file at /tmp/.analytics_state rate-limits re-execution, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env vars are honored as a cover story framing this as an analytics SDK. A second module, lib/telemetry.js, is bundled in the same tarball with the same fetch-decode-write-chmod-spawn shape and additional API-name concatenation obfuscation (require('child_'+'process'), fs['chmod'+'Sync']). Package name and 'bnpl-table' framing do not match the observed behavior.

dolyame-boxy-independent-bnpl-table@35.3.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code