MAL-2026-13341
Malicious code in dolyame-boxy-mobile-bnpl-header (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0) On require of the package, _shim.js assembles remote hostnames at runtime by joining split string fragments (four Cloudflare Workers subdomains such as oob-worker.cf101-adf.workers.dev / cf103-070 / cf102-baf / cf99-9b3, with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with unref(). Execution is gated behind a lock file and DO_NOT_TRACK/ANALYTICS_OPT_OUT environment variables framed as telemetry opt-outs. The runtime-reconstructed destinations, disguised filenames, and detached background execution demonstrate deliberate concealment. Nothing in the package's stated 'device integration / BNPL header' purpose justifies fetching and executing an opaque binary from anonymous Cloudflare Workers hosts on module load.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for dolyame-boxy-mobile-bnpl-header (npm). Pin to a known-safe version or switch to an alternative.