MAL-2026-13330

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-independent-bnpl-swagger/MAL-2026-13330.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13330
Published
2026-08-05T15:20:44Z
Modified
2026-08-05T16:50:56Z
Summary
Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3)

dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from array-fragment string joins (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) to defeat literal-string scanning, downloads a per-platform binary payload, writes it to /tmp as a hidden dotfile on Unix or to the Windows temp directory as dotnet_diag_*.exe, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe. When HTTPS delivery fails, it falls back to a DNS TXT covert channel against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru: it reads a record count from c. and reassembles base64-encoded binary bytes from numbered TXT records. The fetched code is unpinned, unsigned, and unrelated to the package's declared BNPL swagger purpose. A separate lib/telemetry.js bundles the same drop-and-exec primitives (fs["chmod"+"Sync"], cp.spawn("/bin/sh", ["-c", filePath+" &"])) using bracket-string reconstruction; it is not reachable from the current main entrypoint but is staged in the tarball.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015662",
            "import_time": "2026-08-05T16:13:29.504731565Z",
            "modified_time": "2026-08-05T15:20:44Z",
            "sha256": "8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3",
            "source": "amazon-inspector",
            "versions": [
                "35.6.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-independent-bnpl-swagger

Package

Name
dolyame-boxy-independent-bnpl-swagger
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-independent-bnpl-swagger

Affected ranges

Affected versions

35.*
35.6.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.js",
            "sha256": "f020237341f65a3b3d09b7118c67830a4796c0b94f525dd8253649ce0a4a62bb",
            "tlsh": "cfa1b76a16aa30198bb0d7f48717581af55bf2633380c5d8fb5c65980fb212483b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "d84adfce49a07956a0495a3e1354a72931de83b79d772173ace39746df6ea8fd",
            "tlsh": "4b835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-boxy-independent-bnpl-swagger-35.6.8.tgz",
            "hashes": {
                "sha1": "de21b7999ef0c50183c21844e8463ed504985e76",
                "sha512_sri": "sha512-RtYnmTuvOOu2efp2r+/fZGF4bPJ5p9mV3HLBGGnoJKfrcqK539XLaTKLwQHuk6GnQTNIDl135VjANvRTQxoWGA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-independent-bnpl-swagger/MAL-2026-13330.json"