MAL-2026-13340

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-footer/MAL-2026-13340.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13340
Published
2026-08-05T15:19:30Z
Modified
2026-08-05T16:51:00.530057331Z
Summary
Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb)

The package's main entry (index.js) requires./compat, which at import time downloads a platform-specific executable from author-controlled endpoints assembled at runtime by joining string arrays: oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, and oob-worker.cf103-070.workers.dev. A fallback path reconstructs a base64 payload from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A per-platform download map selects /pkg/package (linuxx64), /pkg/loadermac (darwin), or /pkg/package.exe (win32). The fetched bytes are written to a decoy path (/tmp/.cache<hex> on Unix or TEMP/dotnetdiag<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c '<file> &' or cmd.exe start /b. lib/telemetry.js ships a second copy of the same primitive under an SDK/telemetry cover story: childprocess is acquired via require("child"+"process"), fs.chmodSync is called as fs["chmod"+"Sync"], and the payload is reassembled with Buffer.from(chunks,"base64") before being spawned. Hostnames, function names, and dropped-file names are constructed at call time to evade static inspection, and the persisted file uses hidden dotfile / Windows diagnostic-tool decoy names (.cache<hex>, dotnetdiag<hex>.exe,.analyticsstate). The package name presents as a payment/BNPL footer component, which does not match the observed behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb",
            "id": "IN-MAL-2026-015654",
            "modified_time": "2026-08-05T15:19:30Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T16:13:28.665839856Z",
            "versions": [
                "35.4.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-mobile-bnpl-footer

Package

Name
dolyame-boxy-mobile-bnpl-footer
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-mobile-bnpl-footer

Affected ranges

Affected versions

35.*
35.4.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "c8cb3b5f56b3f73fd599b9f39e1a3db695a7bdb4beae2d701ac33c5a32f51350",
            "path": "_compat.js",
            "tlsh": "88a1959a16aa70198f70e7e0c7164816f66bf6633780c2c4fb5c54845f7222483b2efc"
        },
        {
            "sha256": "2309b76c8cf8edac10e0c26f9ef0e5fd258075c58c4f418e05e6316ec5db7b81",
            "path": "lib/telemetry.js",
            "tlsh": "5c835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-dCWaxRpyh3xXwr5Y/njfVhtuYBsdaWTzMhQUX1wwgIz+11FbAj1mPm40UstTOSXSeBTmawuOxdc2lU5308zLXg==",
                "sha1": "67edba48e29a12a1a524531f80cf9d64bf437525"
            },
            "filename": "dolyame-boxy-mobile-bnpl-footer-35.4.7.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-footer/MAL-2026-13340.json"