dolyame-boxy-atom-bnpl-badge @35.2.3

Summary

On require() of dolyame-boxy-atom-bnpl-badge, _helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors (oob-worker.cf100-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-*.workers.dev, oob-worker.cf199-*.workers.dev) with a DNS-TXT chunked fallback through sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Destination hostnames and API names are assembled via array-join fragments (e.g. ['oob-worker.cf103-070.wo','rkers','.dev'].join(''); require('child_'+'process'); 'chmod'+'Sync') to evade static matching. The downloaded bytes are written to a disguised path in /tmp or %TEMP% as dotnet_diag_<hex>.exe or.cache_<hex>, chmod 0755 on POSIX, then spawned detached with stdio ignored via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true,stdio:'ignore'}).unref(). No hash or signature verification. Execution is gated by a.analytics_state marker file and by env vars named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK to impersonate a telemetry opt-out. The dropper is unrelated to the package's stated BNPL-badge purpose. A sibling lib/telemetry.js frames the chain as analytics as a cover story.

Source: amazon-inspector (31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7)