MAL-2026-13125

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-image-plus-text/MAL-2026-13125.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13125
Published
2026-08-05T15:19:13Z
Modified
2026-08-05T15:52:35.078331953Z
Summary
Malicious code in dolyame-boxy-mobile-bnpl-image-plus-text (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (653c411e19cc545e0b3189f5bc2cc24b583b574fe661c27eeedae4f5f3372ecb)

The package's main entry (index.js) unconditionally requires vendor.js, which on load runs an async routine that selects a platform-specific payload URL, downloads bytes from Cloudflare Workers dev hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback channel over *.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes the bytes to a temp file under a disguised name (dotnetdiag_*.exe on Windows,.cache_* on Unix), chmods 755, and spawns the file detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reassembled at runtime from split string arrays (e.g. ['oob','-worke','r.cf102-baf.workers','.d','ev'].join('')) to evade indicator scanning. A DNS-TXT channel resolves TXT records at c.<domain> and <i>.<domain> and base64-decodes them to reconstruct payload bytes. lib/telemetry.js masquerades as a Sentry-like SDK and contains a parallel drop-and-exec implementation (base64 chunk assembly, chmodSync 755, cp.spawn('/bin/sh',['-c', filePath+' &'])); it is not currently required from index.js but is shipped in the tarball as a secondary payload carrier. The behavior is framed as analytics with a DISABLE_TELEMETRY opt-out, but the shipped code is a full remote-code-execution dropper: opaque per-OS binaries from author-controlled mutable endpoints, no hash or signature verification, masquerading filenames, and detached execution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:19:13Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015652",
            "import_time": "2026-08-05T15:20:01.736285792Z",
            "sha256": "653c411e19cc545e0b3189f5bc2cc24b583b574fe661c27eeedae4f5f3372ecb",
            "versions": [
                "35.6.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-mobile-bnpl-image-plus-text

Package

Name
dolyame-boxy-mobile-bnpl-image-plus-text
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-mobile-bnpl-image-plus-text

Affected ranges

Affected versions

35.*
35.6.6

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-boxy-mobile-bnpl-image-plus-text-35.6.6.tgz",
            "hashes": {
                "sha512_sri": "sha512-2O7CNB4zqf8du7wsobCIrrw1prAhGFkaTYzABwatrqZQJ6e5vx0foKYvWAwGeqJ1847wmhSzqIqoly+8yqzxNg==",
                "sha1": "aeeb427d49c6037b96ff01b6d785eec60a6a6286"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "c8a1849a116a30184bb097e48617481af65bf6633380c294f79c69985f7652483b1efc",
            "sha256": "4020c4a65321a414832d3533b8f69655e3e0b1872f839cb272f181fe5f5a6d0a",
            "path": "_vendor.js"
        },
        {
            "tlsh": "fc835055566a602186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "0e924765309779b5ed0ba1198b9231420db837648743fd3ca8956de3a2245894",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-image-plus-text/MAL-2026-13125.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]