registry / dolyame-boxy-mobile-bnpl-button-set / 35.8.1

dolyame-boxy-mobile-bnpl-button-set@35.8.1

native bridge

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package automatically executes a hidden loader. The loader downloads an opaque platform payload, saves it in a temporary directory, and starts it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of the package entrypoint.

Impact

Unconsented remote code execution under the importing process's user privileges.

Mechanism

Import-time remote binary download, drop, chmod, and detached execution.

Attack narrative

Requiring index.js silently requires _shim.js, whose top-level run() function creates a temporary stamp, retrieves a platform-specific opaque payload from rotating HTTPS hosts or DNS TXT records, writes it to a temporary file, makes it executable on Unix, and launches it detached via shell or cmd.exe. The package provides no legitimate reason for this import-time downloader/executor.

Rationale

This is a concrete import-time staged payload chain with remote code execution, not ordinary telemetry. The unused telemetry file also contains materially similar downloader/launcher primitives, reinforcing intentional concealment.

Evidence

package.jsonindex.js_shim.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

On require, index.js loads _shim.js which selects a platform-specific endpoint from a set of runtime-assembled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are hidden by splitting across array fragments joined at runtime. _shim.js downloads an opaque binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under decoy filenames (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmods it 0755, and spawns it detached via cmd.exe /c start or /bin/sh -c '<file> &'. A marker file analytics_state/.analytics_state is written, stderr logging is suppressed, and environment opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) frame the dropper as telemetry. A dormant 81 KB lib/telemetry.js contains a parallel download-write-chmod-spawn code path with base64 payload reassembly, not currently referenced. The declared purpose of the package (a BNPL button UI component) does not require fetching or executing native binaries.

dolyame-boxy-mobile-bnpl-button-set@35.8.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code