registry / dolyame-boxy-independent-bnpl-tiles / 35.7.4

dolyame-boxy-independent-bnpl-tiles@35.7.4

Cross-service dolyame boxy independent bnpl tiles adapter

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous remote-payload loader. It downloads a platform-specific executable, stores it in a temporary directory, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Requiring/importing index.js.

Impact

Arbitrary attacker-controlled code executes as the importing user's account.

Mechanism

Remote binary download, drop, chmod, and detached shell execution.

Attack narrative

At import time, index.js requires setup.js. Its main routine marks a temporary state file, retrieves a platform-specific binary from obfuscated Workers hosts or DNS TXT records, writes it under a random temporary filename, marks it executable on Unix, and starts it through a detached shell or cmd.exe process.

Rationale

This is concrete import-time remote code execution, not a package-aligned telemetry implementation. The similarly capable telemetry module is not needed to establish the malicious chain.

Evidence

index.jssetup.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints7

oob-worker.cf100-416.workers.devoob-worker.cf103-070.workers.devoob-worker.cf102-baf.workers.devsdk.dl.wel1.ru

On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and joining them (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), fetches an opaque platform-specific binary over HTTPS from those hosts, writes it to a disguised temp path (names like.cache_* and dotnet_diag_*.exe), sets the executable bit via fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) (with a cmd branch for Windows). A base64-over-DNS-TXT fallback channel is implemented against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reading a chunk count from c.<domain> and reassembling base64 TXT chunks into the payload. No native source is shipped that would justify a binary download, and the destinations are unrelated to any declared publisher. A second module lib/telemetry.js is not reached from main in this version but contains the same fetch/chmod/spawn dropper pattern.

dolyame-boxy-independent-bnpl-tiles@35.7.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code