{"schema_version":"1.8.0","id":"MAL-2026-13125","published":"2026-08-05T15:19:13Z","modified":"2026-08-05T15:52:35.078331953Z","summary":"Malicious code in dolyame-boxy-mobile-bnpl-image-plus-text (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (653c411e19cc545e0b3189f5bc2cc24b583b574fe661c27eeedae4f5f3372ecb)\nThe package's main entry (index.js) unconditionally requires _vendor.js, which on load runs an async routine that selects a platform-specific payload URL, downloads bytes from Cloudflare Workers dev hosts (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT base64 fallback channel over *.wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes the bytes to a temp file under a disguised name (dotnet_diag_*.exe on Windows,.cache_* on Unix), chmods 755, and spawns the file detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reassembled at runtime from split string arrays (e.g. ['oob','-worke','r.cf102-baf.workers','.d','ev'].join('')) to evade indicator scanning. A DNS-TXT channel resolves TXT records at c.<domain> and <i>.<domain> and base64-decodes them to reconstruct payload bytes. lib/telemetry.js masquerades as a Sentry-like SDK and contains a parallel drop-and-exec implementation (base64 chunk assembly, chmodSync 755, cp.spawn('/bin/sh',['-c', filePath+' &'])); it is not currently required from index.js but is shipped in the tarball as a secondary payload carrier. The behavior is framed as analytics with a DISABLE_TELEMETRY opt-out, but the shipped code is a full remote-code-execution dropper: opaque per-OS binaries from author-controlled mutable endpoints, no hash or signature verification, masquerading filenames, and detached execution.\n","affected":[{"package":{"name":"dolyame-boxy-mobile-bnpl-image-plus-text","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-mobile-bnpl-image-plus-text"},"versions":["35.6.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"4020c4a65321a414832d3533b8f69655e3e0b1872f839cb272f181fe5f5a6d0a","tlsh":"c8a1849a116a30184bb097e48617481af65bf6633380c294f79c69985f7652483b1efc"},{"path":"lib/telemetry.js","sha256":"0e924765309779b5ed0ba1198b9231420db837648743fd3ca8956de3a2245894","tlsh":"fc835055566a602186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-image-plus-text-35.6.6.tgz","hashes":{"sha1":"aeeb427d49c6037b96ff01b6d785eec60a6a6286","sha512_sri":"sha512-2O7CNB4zqf8du7wsobCIrrw1prAhGFkaTYzABwatrqZQJ6e5vx0foKYvWAwGeqJ1847wmhSzqIqoly+8yqzxNg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-image-plus-text/MAL-2026-13125.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-image-plus-text/v/35.6.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015652","import_time":"2026-08-05T15:20:01.736285792Z","modified_time":"2026-08-05T15:19:13Z","sha256":"653c411e19cc545e0b3189f5bc2cc24b583b574fe661c27eeedae4f5f3372ecb","source":"amazon-inspector","versions":["35.6.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}