registry / dolyame-boxy-independent-bnpl-text-block / 35.5.3

dolyame-boxy-independent-bnpl-text-block@35.5.3

Pluggable dolyame boxy independent bnpl text block interface

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently stages and launches a remote binary. It uses rotating HTTPS mirrors with DNS TXT fallback and creates a temporary execution marker.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js require/import of the package main entrypoint.

Impact

Arbitrary attacker-supplied native code executes with the privileges of the importing process.

Mechanism

remote payload download, drop, chmod, and detached execution

Attack narrative

The main entrypoint catches and suppresses errors while importing _runtime.js. That module immediately retrieves an opaque platform payload from rotating Workers hosts, falling back to attacker-controlled DNS TXT chunks. It writes the result to a temporary executable path, grants execute permission on Unix, and launches it detached through /bin/sh or cmd.exe. This is a concrete import-time remote-code-execution chain, not legitimate telemetry.

Rationale

The package's stated API does not require a native executable, yet import-time code silently downloads and executes one with no meaningful integrity verification. The remote payload source and execution are attacker-controlled.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%/analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints7

On require() of the package, index.js loads _runtime.js, which assembles Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) and DNS-TXT fallback hosts under dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) from split-and-joined string fragments to conceal them from static analysis. It fetches a platform-specific executable payload from those hosts, writes it to a randomly-named file in /tmp or %TEMP% with cover-story names (dotnet_diag_<rnd>.exe,.cache_<rnd>,.analytics_state), chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd /c start. The tarball also ships lib/telemetry.js, an ~81KB unreferenced sibling module implementing the same fetch-write-chmod-spawn pattern with base64-reconstructed payload bytes and string-concatenated 'child_'+'process' / 'chmod'+'Sync' references. The package's declared purpose as a BNPL text-block UI helper has no relationship to the observed dropper behavior.

dolyame-boxy-independent-bnpl-text-block@35.5.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code