dolyame-boxy-independent-bnpl-info-images @20.7.2

Summary

On require() of the package, index.js loads _adapter.js which selects a platform-specific payload path, downloads a binary from runtime-assembled Cloudflare workers.dev hostnames (with a DNS TXT fallback channel via *.dl.well1.site), writes it to /var/tmp or %TEMP% under decoy names (.cache_<hex>, dotnet_diag_<hex>.exe,.analytics_state), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are assembled by Array.join from split fragments to evade static matching. The package's advertised public API (DolyameBoxyIndependentBnplInfoImages with init/version/configure) is a no-op wrapper; the only real behavior triggered by importing the package is the covert binary drop-and-execute in _adapter.js. No hash or signature verification is performed on the fetched binary, and the destination hosts are unrelated to any BNPL/imaging functionality the name implies.

Source: amazon-inspector (bbef858bd27bf2cda5b64bb9171d90ffa7b7d95337277030c75f9fd4ea32c6f2)