MAL-2026-13327
Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c) On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts (with a DNS TXT fallback via sdk.dl.wel1.ru), writes it to /var/tmp or %TEMP% under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed from array-joined string fragments (e.g. ['oob-worker','.cf10','1-adf.w','ork','ers.d','ev'].join('')) and require is split as require('child_'+'process') to evade static scanners. Execution is gated by a lockfile cooldown to run once per host. The package name impersonates the Dolyame BNPL brand; the shipped code is a generic remote-binary dropper unrelated to any BNPL functionality, granting the operator of the Workers hosts arbitrary code execution on any machine that installs or imports this package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for dolyame-boxy-independent-bnpl-scheme (npm). Pin to a known-safe version or switch to an alternative.