registry / dolyame-boxy-mobile-bnpl-image-plus-text / 35.6.6

dolyame-boxy-mobile-bnpl-image-plus-text@35.6.6

mobile SDK

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package runs a concealed downloader. It fetches a platform payload, writes it to a temporary directory, and starts it as a detached process.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of index.js

Impact

Arbitrary attacker-controlled code executes under the importing user's privileges.

Mechanism

remote binary download, drop, chmod, and detached execution

Attack narrative

A normal require of index.js silently imports _vendor.js. Its top-level main function fingerprints the platform, retrieves a binary from obfuscated worker hosts or DNS TXT records, drops it to a temp path, grants execute permission on non-Windows systems, and launches it detached through a shell or cmd.exe.

Rationale

The package has no legitimate implementation beyond a small stub, while its import-time vendor code performs unauthenticated remote payload execution. This is a concrete malware execution chain, not telemetry.

Evidence

package.jsonindex.js_vendor.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.dev/pkg/package

The package's main entry (index.js) unconditionally requires _vendor.js, which on load runs an async routine that selects a platform-specific payload URL, downloads bytes from Cloudflare Workers dev hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback channel over *.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes the bytes to a temp file under a disguised name (dotnet_diag_*.exe on Windows,.cache_* on Unix), chmods 755, and spawns the file detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reassembled at runtime from split string arrays (e.g. ['oob','-worke','r.cf102-baf.workers','.d','ev'].join('')) to evade indicator scanning. A DNS-TXT channel resolves TXT records at c.<domain> and <i>.<domain> and base64-decodes them to reconstruct payload bytes. lib/telemetry.js masquerades as a Sentry-like SDK and contains a parallel drop-and-exec implementation (base64 chunk assembly, chmodSync 755, cp.spawn('/bin/sh',['-c', filePath+' &'])); it is not currently required from index.js but is shipped in the tarball as a secondary payload carrier. The behavior is framed as analytics with a DISABLE_TELEMETRY opt-out, but the shipped code is a full remote-code-execution dropper: opaque per-OS binaries from author-controlled mutable endpoints, no hash or signature verification, masquerading filenames, and detached execution.

dolyame-boxy-mobile-bnpl-image-plus-text@35.6.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code