{"schema_version":"1.8.0","id":"MAL-2026-13126","published":"2026-08-05T15:19:23Z","modified":"2026-08-05T15:52:36.059558299Z","summary":"Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870)\nOn require of this package, index.js unconditionally loads _ext.js, which reconstructs C2 hostnames at runtime by joining split string fragments (assembling *.workers.dev endpoints with a DNS TXT-record fallback resolving under *.dl.wel1.ru). _ext.js selects a platform-specific URL, downloads an opaque native binary via https.get, writes it to a hidden temp file named.cache_<hex> on Unix or dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. Function references such as child_process are string-concatenated (require(\"child_\"+\"process\")) and file names masquerade as.NET diagnostic or cache artifacts; comments frame the behavior as opt-out telemetry. A secondary dropper with matching primitives (base64 chunk assembly, fs.chmodSync|0o755, cp.spawn('/bin/sh', ['-c', path+' &'])) is shipped as lib/telemetry.js (~81KB), not referenced from index.js in this version but bundled in the tarball. The package name impersonates a payments/BNPL gallery SDK; the actual runtime behavior is a drop-and-execute of author-controlled native code on any host that installs or imports this version.\n","affected":[{"package":{"name":"dolyame-boxy-mobile-bnpl-picture-gallery","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-mobile-bnpl-picture-gallery"},"versions":["35.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"3b7ee7899ccdcc58730ca27a26792110633e96619cdbabb2c8ed3c664f695437","tlsh":"8ea19a5a166670084bb0dbe4c7275415f55be663378082d4fb9ca9981fb613483f2efc"},{"path":"lib/telemetry.js","sha256":"f35a296d79fdd62e040829d01b233d00589c6358d90849f7cf226beb7ff37470","tlsh":"6b835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-picture-gallery-35.2.9.tgz","hashes":{"sha1":"434ca48ba41608e3ace9a9d1042e4406e0e40678","sha512_sri":"sha512-nYGk13cnCkVbZrHFxKzW1nvATf7f3LJiKPJZLBeNNsW22aMjPrta5uEcMYKXv6T+22G1nZat0E5VbhN6Kxq7AA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-picture-gallery/MAL-2026-13126.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-picture-gallery/v/35.2.9"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015653","import_time":"2026-08-05T15:20:01.766709625Z","modified_time":"2026-08-05T15:19:23Z","sha256":"1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870","source":"amazon-inspector","versions":["35.2.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}