dolyame-boxy-desktop-bnpl-title @35.6.5
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-13310
Ecosystem
npm
Summary
The package main ( index.js ) requires ./_init on load. _init.js assembles hostnames via string-split .join('') obfuscation to produce a rotating list of Cloudflare Workers endpoints ( oob-worker.cf103-070.workers.dev , oob-worker.cf99-9b3.workers.dev , oob-worker.cf100-416.workers.dev , oob-worker.cf101-adf.workers.dev ) plus a DNS-TXT covert-channel fallback via *.dl.wel1.ru ( sdk.dl.wel1.ru , ext.dl.wel1.ru , pkg.dl.wel1.ru , net.dl.wel1.ru ). It downloads a platform-specific binary, writes it to /var/tmp or %TEMP% under disguised names ( dotnet_diag_<rand>.exe , .cache_<rand> ), sets mode 0755 on POSIX, and spawns it detached via /bin/sh -c... & or cmd /c start /b . Environment flags such as DISABLE_TELEMETRY , ANALYTICS_OPT_OUT , and DO_NOT_TRACK act as kill switches. A second dropper is bundled in lib/telemetry.js (81 KB), which reconstructs a payload from base64-encoded DNS TXT chunks and executes it using the same detached-shell pattern, hidden behind require('child_'+'process') , fs['chmod'+'Sync'] , and an analytics-sdk cover story. The package's advertised purpose has no relationship to any such native runtime.
Source: amazon-inspector (51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.