dolyame-boxy-mobile-bnpl-header @35.3.6
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-13341
Ecosystem
npm
Summary
On require of the package, _shim.js assembles remote hostnames at runtime by joining split string fragments (four Cloudflare Workers subdomains such as oob-worker.cf101-adf.workers.dev / cf103-070 / cf102-baf / cf99-9b3, with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with unref(). Execution is gated behind a lock file and DO_NOT_TRACK/ANALYTICS_OPT_OUT environment variables framed as telemetry opt-outs. The runtime-reconstructed destinations, disguised filenames, and detached background execution demonstrate deliberate concealment. Nothing in the package's stated 'device integration / BNPL header' purpose justifies fetching and executing an opaque binary from anonymous Cloudflare Workers hosts on module load.
Source: amazon-inspector (405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.