MAL-2026-13329
Malicious code in dolyame-boxy-independent-bnpl-separator (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46) On load, index.js unconditionally requires _platform.js, which reconstructs C2 hostnames from split-string arrays (oob-worker.cf*.workers.dev with fallbacks to sdk.dl.wel1.ru, pkg.dl.wel1.ru, ext.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows impersonating Microsoft diagnostic tooling), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. A.analytics_state marker gates re-execution. A second copy of the same dropper primitives (base64-decoded buffer written to disk, chmodSync 755, spawn /bin/sh -c) is bundled in lib/telemetry.js behind a 'tracing.node' cover story. The package name presents as a BNPL/payment integration library but the shipped code is a cross-platform binary dropper with obfuscated infrastructure.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for dolyame-boxy-independent-bnpl-separator (npm). Pin to a known-safe version or switch to an alternative.