MAL-2026-13127

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-popup/MAL-2026-13127.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13127
Published
2026-08-05T15:19:05Z
Modified
2026-08-05T15:52:36.155058627Z
Summary
Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074)

On require(), index.js loads loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via string-split concatenation (oob-worker.cf1-02-baf.workers.dev and siblings) with a DNS-TXT fallback that reassembles a base64 payload from numbered TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to /tmp/.cache<rand> or %TEMP%/dotnetdiag<rand>.exe, chmods 0755, and detached-spawns it via spawn('/bin/sh',['-c', fp+' &']) or spawn('cmd',...). No signature or hash verification is performed, hosts are obfuscated to evade static analysis, staging paths and filenames mimic telemetry/diagnostic naming, and the package name misappropriates a payments-BNPL brand context that has no legitimate reason to fetch and execute arbitrary binaries at import time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T15:20:01.70350869Z",
            "versions": [
                "35.1.9"
            ],
            "id": "IN-MAL-2026-015651",
            "source": "amazon-inspector",
            "sha256": "1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074",
            "modified_time": "2026-08-05T15:19:05Z"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-mobile-bnpl-popup

Package

Name
dolyame-boxy-mobile-bnpl-popup
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-mobile-bnpl-popup

Affected ranges

Affected versions

35.*
35.1.9

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "abb1b95606a670184bb0dbe0ca1b5825f55bf6633b81c284f79c66885f735248373efc",
            "sha256": "7cda30a58f628bfe39e7c8ad39deb8c47177c01a56299a9c1960f9239d6beeea",
            "path": "_loader.js"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "fba96e8599510ca1ec55061c53215db2e6ba8220",
                "sha512_sri": "sha512-yRmfRKe7au/2tkv3ltSXZIuQq9fi/QIqlHa1l4Qg2ps9rEci07DlWnRUsTrJllD4nR+f07jDmwPkBq3R3h6rEQ=="
            },
            "filename": "dolyame-boxy-mobile-bnpl-popup-35.1.9.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-popup/MAL-2026-13127.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]