MAL-2026-13550

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-atom-bnpl-navigation-arrow/MAL-2026-13550.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13550
Published
2026-08-07T12:25:42Z
Modified
2026-08-07T13:20:27.936812227Z
Summary
Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0)

On require() of the package, index.js loads bridge.js which unconditionally executes a setup routine that downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) whose hostnames are reconstructed at runtime by joining split string fragments. The bytes are written to /var/tmp or %TEMP% under names mimicking legitimate artifacts (dotnetdiag<hex>.exe on Windows,.cache<hex> on Unix), chmod 0755'd, and launched detached via /bin/sh -c "<path> &" or cmd.exe /c start. When the HTTPS mirrors fail, bridge.js falls back to a DNS-TXT covert channel: it queries TXT records at c.<domain> against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru to learn a chunk count, then retrieves the payload in numbered TXT records and base64-decodes the concatenation before writing and executing it through the same sink. The childprocess module name is itself split ("child_"+"process") to evade static matching, and execution is gated by a ~19958-second cooldown plus DISABLETELEMETRY / DONOT_TRACK checks used as cover. Package name and version pattern are consistent with a typosquat / dependency-confusion lure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016976",
            "sha256": "7db1d9b70bff8856c1f954e47b1b609be3a4123a0c937a4eecf70c3a598325f0",
            "import_time": "2026-08-07T12:51:20.58323679Z",
            "modified_time": "2026-08-07T12:25:42Z",
            "versions": [
                "35.6.5"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-atom-bnpl-navigation-arrow

Package

Name
dolyame-boxy-atom-bnpl-navigation-arrow
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-atom-bnpl-navigation-arrow

Affected ranges

Affected versions

35.*
35.6.5

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "d9b56186e7c6af6232a77b52ababedd83353a21a4ec3d0edfd7eb21c235d7b23",
            "tlsh": "eba198aa116670084b70dbe4c7175416f65af2637380c298fb9ca9980fb352482f2ffc",
            "path": "_bridge.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-boxy-atom-bnpl-navigation-arrow-35.6.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-F5m/Lyp2l8+N2u2ucckjB2X+8/x3ZoMQxCZMhBUZSKcf7hRZCK7gK+XPF5RzR8kVb5bsRZaDDVnzKRWhIDnrjA==",
                "sha1": "ade75b7d318632c824b61df77db8ba28b0da58f4"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-atom-bnpl-navigation-arrow/MAL-2026-13550.json"