MAL-2026-13339

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-card-panel/MAL-2026-13339.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13339
Published
2026-08-05T15:20:56Z
Modified
2026-08-05T16:51:00.180131809Z
Summary
Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218)

On require, bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (e.g. dotnetdiag_*.exe,.cache_*), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. When HTTPS mirrors fail, the code falls back to a DNS-TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru: it queries a c.<domain> TXT record for a chunk count, then retrieves base64 chunks from 0.<domain>..N-1.<domain>, concatenates, base64-decodes, and hands the bytes to the same write-chmod-spawn sink. Destination hostnames and DNS domains are assembled at runtime from fragmented string arrays (e.g. ["oob-worker.cf103","-070.worker","s.de","v"].join("")) to evade static matching. A TTL cache at /tmp/.analytics_state throttles re-execution; opt-out exists only via undocumented environment variables. Package presents itself as a payment/device integration library, but the traced load-time behavior is fetch-and-execute of opaque attacker-controlled binaries.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T16:13:29.641074924Z",
            "sha256": "81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218",
            "modified_time": "2026-08-05T15:20:56Z",
            "id": "IN-MAL-2026-015663",
            "versions": [
                "35.3.4"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-mobile-bnpl-card-panel

Package

Name
dolyame-boxy-mobile-bnpl-card-panel
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-mobile-bnpl-card-panel

Affected ranges

Affected versions

35.*
35.3.4

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Wti4GwK03TPxVr/wN6XOtj9y1e8KEYwd2ZTTKaAyZW0GlpREmKo9n5XWqKC+HjUUo+9vyuxuDgegpEeHpGTArQ==",
                "sha1": "d7aae50feda90280cfc5c9f8e23076570f2f7b8f"
            },
            "filename": "dolyame-boxy-mobile-bnpl-card-panel-35.3.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "sha256": "a5609e581121c53d049077be740d56461f66232414ae06e9f03d07dfaecfacec",
            "tlsh": "95b1a69a16a670194bb09be0c7178416fa5bf2633380d2c4fa5ca5940fb7124c3b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-card-panel/MAL-2026-13339.json"