MAL-2026-13129

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-title/MAL-2026-13129.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13129
Published
2026-08-05T15:17:59Z
Modified
2026-08-05T15:52:37.381433452Z
Summary
Malicious code in dolyame-boxy-mobile-bnpl-title (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2)

index.js unconditionally requires./setup on module load. setup.js branches on process.platform (linux/darwin/win32), fetches an opaque binary from Cloudflare Workers hosts whose names are assembled at runtime from split-string arrays joined together (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT-record base64 fallback under .dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache<hex> or %TEMP%\dotnetdiag<hex>.exe, chmod 0755'd, and spawned detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}) or cp.spawn('cmd.exe',['/c','start','/b',fp]). No pinning, no hash, no signature verification. Cover-story naming (file 'setup.js', state file '.analyticsstate', dropped binary 'dotnetdiag.exe', opt-out env vars DISABLETELEMETRY / ANALYTICSOPTOUT / DONOTTRACK) frames the behavior as telemetry. lib/telemetry.js (~81 KB) ships the same dropper runtime (Buffer.from(chunks,'base64'); fs'chmod'+'Sync'; cp.spawn('/bin/sh',['-c',filePath+' &']); require('child'+'process')) though not wired into the current load path. Requiring this package results in arbitrary attacker-controlled code executing on the installer's host with the user's privileges.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:17:59Z",
            "id": "IN-MAL-2026-015643",
            "import_time": "2026-08-05T15:20:01.357480085Z",
            "versions": [
                "35.1.7"
            ],
            "source": "amazon-inspector",
            "sha256": "180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-mobile-bnpl-title

Package

Name
dolyame-boxy-mobile-bnpl-title
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-mobile-bnpl-title

Affected ranges

Affected versions

35.*
35.1.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-boxy-mobile-bnpl-title-35.1.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-ps7Y9nV2ZLwEsvzO29RF1k7Ic6bYjd80XTRmZNq9qXN+zgC3FTxrWsSGRhV7hUEy8dAv6zUaeCQisJI3zONFfw==",
                "sha1": "f1454e7c719f8a29ea27fa7be422b7d46ca43bae"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "setup.js",
            "tlsh": "46a1769a16aa701c4bb0a7f4c6174416f656f663338086d8fb9c69981fb352483b1efc",
            "sha256": "608070eabc666875356636275ba504977e9570beebef06027324037258545d15"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "91835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "29555b7d74fe59cf7b5111387d6fa75249c866a80b2583b5d9dc6ca72e9b3369"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-title/MAL-2026-13129.json"