MAL-2026-13126

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-picture-gallery/MAL-2026-13126.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13126
Published
2026-08-05T15:19:23Z
Modified
2026-08-05T15:52:36.059558299Z
Summary
Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870)

On require of this package, index.js unconditionally loads ext.js, which reconstructs C2 hostnames at runtime by joining split string fragments (assembling *.workers.dev endpoints with a DNS TXT-record fallback resolving under *.dl.wel1.ru). ext.js selects a platform-specific URL, downloads an opaque native binary via https.get, writes it to a hidden temp file named.cache<hex> on Unix or dotnetdiag<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. Function references such as childprocess are string-concatenated (require("child_"+"process")) and file names masquerade as.NET diagnostic or cache artifacts; comments frame the behavior as opt-out telemetry. A secondary dropper with matching primitives (base64 chunk assembly, fs.chmodSync|0o755, cp.spawn('/bin/sh', ['-c', path+' &'])) is shipped as lib/telemetry.js (~81KB), not referenced from index.js in this version but bundled in the tarball. The package name impersonates a payments/BNPL gallery SDK; the actual runtime behavior is a drop-and-execute of author-controlled native code on any host that installs or imports this version.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T15:20:01.766709625Z",
            "id": "IN-MAL-2026-015653",
            "sha256": "1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870",
            "modified_time": "2026-08-05T15:19:23Z",
            "source": "amazon-inspector",
            "versions": [
                "35.2.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-mobile-bnpl-picture-gallery

Package

Name
dolyame-boxy-mobile-bnpl-picture-gallery
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-mobile-bnpl-picture-gallery

Affected ranges

Affected versions

35.*
35.2.9

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_ext.js",
            "tlsh": "8ea19a5a166670084bb0dbe4c7275415f55be663378082d4fb9ca9981fb613483f2efc",
            "sha256": "3b7ee7899ccdcc58730ca27a26792110633e96619cdbabb2c8ed3c664f695437"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "6b835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "f35a296d79fdd62e040829d01b233d00589c6358d90849f7cf226beb7ff37470"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-boxy-mobile-bnpl-picture-gallery-35.2.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-nYGk13cnCkVbZrHFxKzW1nvATf7f3LJiKPJZLBeNNsW22aMjPrta5uEcMYKXv6T+22G1nZat0E5VbhN6Kxq7AA==",
                "sha1": "434ca48ba41608e3ace9a9d1042e4406e0e40678"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-picture-gallery/MAL-2026-13126.json"