dolyame-boxy-independent-bnpl-open-api @20.8.9

Summary

On require() of the package, index.js loads _helpers.js which immediately invokes start(). start() selects a Windows, Linux, or macOS payload path, downloads an opaque native binary via https.get from one of three hardcoded Cloudflare workers.dev hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS TXT-record fallback under *.dl.well1.site, writes it to /tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods it 0755, and detached-spawns it via /bin/sh -c or cmd /c start /b. Hostnames are assembled by array-join string concatenation and child_process is loaded via require("child_"+"process") to evade static string scanning. The package advertises itself as a BNPL API SDK; the fetched binary is unrelated to that stated purpose and uses cover-story filenames (dotnet_diag,.cache_). A secondary lib/telemetry.js (~81 KB) bundles structurally identical dropper primitives (https fetch, chmod 0755, /bin/sh -c detached spawn, base64 chunk decode) though it is not reached from the current main.

Source: amazon-inspector (8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b)