dolyame-boxy-mobile-bnpl-button-set @35.8.1
Vulnerability report · Last retrieved from osv.dev August 8, 2026 at 9:15 PM UTC
OSV ID
MAL-2026-13337
Ecosystem
npm
Summary
On require, index.js loads _shim.js which selects a platform-specific endpoint from a set of runtime-assembled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. Hostnames are hidden by splitting across array fragments joined at runtime. _shim.js downloads an opaque binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under decoy filenames (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmods it 0755, and spawns it detached via cmd.exe /c start or /bin/sh -c '<file> &'. A marker file analytics_state/.analytics_state is written, stderr logging is suppressed, and environment opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) frame the dropper as telemetry. A dormant 81 KB lib/telemetry.js contains a parallel download-write-chmod-spawn code path with base64 payload reassembly, not currently referenced. The declared purpose of the package (a BNPL button UI component) does not require fetching or executing native binaries.
Source: amazon-inspector (ce4829363e0b5248ca374f2bd545b219d5235bbc96936ba5bd9d06f369878538)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.