dolyame-boxy-atom-bnpl-button @35.8.3

Summary

On require, index.js loads _helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join (oob-worker.cf*.workers.dev) with a DNS-TXT chunked-base64 fallback channel to *.dl.wel1.ru, writes the bytes to /tmp/.cache_<rnd> or %TEMP%/dotnet_diag_<rnd>.exe, chmods 0755, and spawns the file detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}) or cmd equivalent on Windows. No integrity or signature check is performed on the fetched bytes. Destination hostnames are string-split to evade static detection, and file/lock names (analytics_state, dotnet_diag_*.exe,.cache_*) plus code comments framing the spawn as 'Detached process to avoid blocking npm install' present the behavior as telemetry. A lockfile with a ~22000s max age throttles re-fetching into a scheduled beacon pattern. The DNS-TXT channel provides a covert payload path when HTTPS egress is blocked. Any installer requiring this package executes attacker-controlled arbitrary code on their host.

Source: amazon-inspector (963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2)