MAL-2026-13297
Malicious code in dolyame-boxy-atom-icon-loader (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766) Package advertised as an icon loader but on require() the bundled _vendor.js downloads a platform-specific executable from obfuscated Cloudflare workers.dev subdomains and *.dl.wel1.ru hosts (oob-worker.cf102-baf.workers.dev, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp or %TEMP% under disguising names (dotnet_diag_*.exe,.cache_*), chmods it 0o755, and spawns it detached via /bin/sh or cmd. Destination hostnames and the child_process require target are reconstructed at runtime via array.join("") splits to evade static scanners. If HTTPS mirrors fail, _vendor.js falls back to a DNS-TXT covert channel that queries c.<domain> for chunk count then N.<domain> for base64-encoded chunks, reassembles the executable, and feeds it to the same write/chmod/exec sink. Behavior does not match the package's declared purpose.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for dolyame-boxy-atom-icon-loader (npm). Pin to a known-safe version or switch to an alternative.