dolyame-boxy-atom-bnpl-card @35.5.5

Summary

On require of the package, index.js loads _adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via array-join concatenation (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a fallback that reassembles the executable from base64 chunks retrieved over DNS TXT records at c.dl.wel1.ru, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names (dotnet_diag_*.exe,.cache_*), chmodded to 0755 via a string-split fs['chmod'+'Sync'] call, and executed detached via spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true}).unref() or a cmd equivalent on Windows. A ~24h marker file suppresses re-execution. A sibling lib/telemetry.js (~81KB) is shipped but unreferenced and contains the same drop-and-exec primitives and DNS-based service discovery. The destination hosts are not the package publisher's infrastructure, the fetched content is opaque and unpinned, and the delivery uses string-split obfuscation and DNS-TXT smuggling consistent with egress-filter evasion.

Source: amazon-inspector (7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7)