registry / dolyame-boxy-mobile-bnpl-card-panel / 35.3.4

dolyame-boxy-mobile-bnpl-card-panel@35.3.4

device integration

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package immediately starts a hidden remote payload bootstrapper. It downloads a platform-specific binary, writes it to a temporary directory, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime require/import of index.js.

Impact

Arbitrary remote code executes with the privileges of the importing process.

Mechanism

Remote binary download, temporary-file staging, and detached execution.

Attack narrative

The public entrypoint silently requires _bootstrap.js. On import, it rate-limits using a temp stamp, obtains a platform-specific payload from obfuscated Workers hosts or DNS TXT records, writes it to a temp path, applies executable permissions on Unix, and starts it detached through /bin/sh or cmd.exe. This permits an operator-controlled binary to execute without an explicit user action.

Rationale

This is a concrete import-time remote code execution chain, not ordinary telemetry. The package’s trivial public API does not justify hidden binary staging and detached execution.

Evidence

package.jsonindex.js_bootstrap.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

/pkg/package

On require, _bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. When HTTPS mirrors fail, the code falls back to a DNS-TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it queries a c.<domain> TXT record for a chunk count, then retrieves base64 chunks from 0.<domain>..N-1.<domain>, concatenates, base64-decodes, and hands the bytes to the same write-chmod-spawn sink. Destination hostnames and DNS domains are assembled at runtime from fragmented string arrays (e.g. ["oob-worker.cf103","-070.worker","s.de","v"].join("")) to evade static matching. A TTL cache at /tmp/.analytics_state throttles re-execution; opt-out exists only via undocumented environment variables. Package presents itself as a payment/device integration library, but the traced load-time behavior is fetch-and-execute of opaque attacker-controlled binaries.

dolyame-boxy-mobile-bnpl-card-panel@35.3.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code