MAL-2026-13331

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-independent-bnpl-table/MAL-2026-13331.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13331
Published
2026-08-05T15:20:30Z
Modified
2026-08-05T16:50:56.479496953Z
Summary
Malicious code in dolyame-boxy-independent-bnpl-table (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b)

On require() of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames (oob-worker.cf*.workers.dev) from string-split fragments joined at runtime, with a DNS-TXT-based fallback resolver using *.dl.wel1.ru domains. It downloads a platform-specific binary (/pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64) via https.get, writes the opaque payload to /var/tmp or the Windows TEMP directory under disguised names (.cache<hex> or dotnetdiag<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd /c start. A stamp file at /tmp/.analyticsstate rate-limits re-execution, and DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK env vars are honored as a cover story framing this as an analytics SDK. A second module, lib/telemetry.js, is bundled in the same tarball with the same fetch-decode-write-chmod-spawn shape and additional API-name concatenation obfuscation (require('child'+'process'), fs['chmod'+'Sync']). Package name and 'bnpl-table' framing do not match the observed behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b",
            "source": "amazon-inspector",
            "versions": [
                "35.3.4"
            ],
            "import_time": "2026-08-05T16:13:29.29098405Z",
            "modified_time": "2026-08-05T15:20:30Z",
            "id": "IN-MAL-2026-015660"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-independent-bnpl-table

Package

Name
dolyame-boxy-independent-bnpl-table
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-independent-bnpl-table

Affected ranges

Affected versions

35.*
35.3.4

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "beae4939a7a63d4437dbd841044dccf7ab3acf16",
                "sha512_sri": "sha512-nsnl0bPuyuD2o26kLYThHsDKIwY5N1k+UKdNAvQOkHINJZghDn4rPailqhA62Lgzt5olG+I9qtE4SFYDUqDtgQ=="
            },
            "filename": "dolyame-boxy-independent-bnpl-table-35.3.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_init.js",
            "sha256": "1331649a992253aab6fabe5e108956d9158bb6e3eb40a343258276e9e2fa6dee",
            "tlsh": "29a1655a1669b0184b70dbe4c61b8826f667f6533780d2c4fb9c65985f7312482b2efc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "534239748629354d8cac60f5342345a65584c53bbe51d5c16c30d421096da5a3",
            "tlsh": "34835055566a202186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-independent-bnpl-table/MAL-2026-13331.json"