dolyame-boxy-atom-bnpl-image-card @35.7.7

Summary

The package's main entry loads setup.js, which on require() fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime via array.join() (e.g. ['oob-worker.cf10','2-baf.w','orker','s.dev'].join('')) to evade static inspection. A DNS-TXT fallback channel under *.dl.wel1.ru retrieves base64-encoded chunks (count via c.<domain>, chunks via <i>.<domain>) that are concatenated and decoded. The retrieved binary is written to /tmp or %TEMP% under cover-story names (.cache_*, dotnet_diag_*.exe), chmod 755'd on POSIX via a split fs['chmod'+'Sync'] call, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or cmd on Windows). No lifecycle hook is required; any consumer that imports the package triggers execution. A sibling lib/telemetry.js, framed as an 'Analytics SDK' and not wired in, contains the same dropper primitives (split require('child_'+'process'), split chmodSync, base64 chunk assembly, detached /bin/sh spawn), indicating a shared dropper family.

Source: amazon-inspector (484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f)