MAL-2026-12365

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-independent-bnpl-info-images/MAL-2026-12365.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12365
Published
2026-08-05T12:26:16Z
Modified
2026-08-05T13:35:19.937548955Z
Summary
Malicious code in dolyame-boxy-independent-bnpl-info-images (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bbef858bd27bf2cda5b64bb9171d90ffa7b7d95337277030c75f9fd4ea32c6f2)

On require() of the package, index.js loads adapter.js which selects a platform-specific payload path, downloads a binary from runtime-assembled Cloudflare workers.dev hostnames (with a DNS TXT fallback channel via *.dl.well1.site), writes it to /var/tmp or %TEMP% under decoy names (.cache<hex>, dotnetdiag<hex>.exe,.analytics_state), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are assembled by Array.join from split fragments to evade static matching. The package's advertised public API (DolyameBoxyIndependentBnplInfoImages with init/version/configure) is a no-op wrapper; the only real behavior triggered by importing the package is the covert binary drop-and-execute in _adapter.js. No hash or signature verification is performed on the fetched binary, and the destination hosts are unrelated to any BNPL/imaging functionality the name implies.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014655",
            "import_time": "2026-08-05T13:08:34.328522187Z",
            "sha256": "bbef858bd27bf2cda5b64bb9171d90ffa7b7d95337277030c75f9fd4ea32c6f2",
            "modified_time": "2026-08-05T12:26:16Z",
            "versions": [
                "20.7.2"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-independent-bnpl-info-images

Package

Name
dolyame-boxy-independent-bnpl-info-images
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-independent-bnpl-info-images

Affected ranges

Affected versions

20.*
20.7.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1SUVlkPBJNS4vw0oWQIZgFLSFjkFvmqyW6jo96E55jui29HPlyeWHwxRVD+LXMr73HvKy+O36obfShi2aViyTw==",
                "sha1": "d1cfb32f04fd2ba2011728813b095ec4ffa6b03d"
            },
            "filename": "dolyame-boxy-independent-bnpl-info-images-20.7.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_adapter.js",
            "sha256": "4b0d26fa30cf63c730c71a9f6410769de8f8aa8c8bdf98666ea160196bc8649d",
            "tlsh": "efb1a75912a5702d8bb0dbe4871b5415f65be6633380c294f79ca9885fb312883b2efc"
        },
        {
            "path": "index.js",
            "sha256": "e3728f21d1d908f7a4f9892eda37124b72d1b078e427ed9db4c6659870ff8a7a",
            "tlsh": "42f04c8e16dff42283b4b2e3ee624062f566e5205b4b82587b8840fe0bb0d1003ddf79"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-independent-bnpl-info-images/MAL-2026-12365.json"