dolyame-boxy-atom-icon-loader @35.1.8

Summary

Package advertised as an icon loader but on require() the bundled _vendor.js downloads a platform-specific executable from obfuscated Cloudflare workers.dev subdomains and *.dl.wel1.ru hosts (oob-worker.cf102-baf.workers.dev, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp or %TEMP% under disguising names (dotnet_diag_*.exe,.cache_*), chmods it 0o755, and spawns it detached via /bin/sh or cmd. Destination hostnames and the child_process require target are reconstructed at runtime via array.join("") splits to evade static scanners. If HTTPS mirrors fail, _vendor.js falls back to a DNS-TXT covert channel that queries c.<domain> for chunk count then N.<domain> for base64-encoded chunks, reassembles the executable, and feeds it to the same write/chmod/exec sink. Behavior does not match the package's declared purpose.

Source: amazon-inspector (34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766)