dolyame-boxy-independent-bnpl-cards @35.7.6
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 5:49 AM UTC
OSV ID
MAL-2026-13314
Ecosystem
npm
Summary
On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT covert-channel fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The payload is written to /tmp or %TEMP% under a disguised name (dotnet_diag_<uid>.exe on Windows,.cache_<uid> on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification, hostnames are assembled from array fragments joined at runtime, and the download destinations are unrelated to the package's stated BNPL-cards purpose. A lockfile named.analytics_state and opt-out env vars named DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK are used as a telemetry cover story.
Source: amazon-inspector (5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.