{"schema_version":"1.8.0","id":"MAL-2026-13127","published":"2026-08-05T15:19:05Z","modified":"2026-08-05T15:52:36.155058627Z","summary":"Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074)\nOn require(), index.js loads _loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via string-split concatenation (oob-worker.cf1-02-baf.workers.dev and siblings) with a DNS-TXT fallback that reassembles a base64 payload from numbered TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to /tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods 0755, and detached-spawns it via spawn('/bin/sh',['-c', fp+' &']) or spawn('cmd',...). No signature or hash verification is performed, hosts are obfuscated to evade static analysis, staging paths and filenames mimic telemetry/diagnostic naming, and the package name misappropriates a payments-BNPL brand context that has no legitimate reason to fetch and execute arbitrary binaries at import time.\n","affected":[{"package":{"name":"dolyame-boxy-mobile-bnpl-popup","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-mobile-bnpl-popup"},"versions":["35.1.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"7cda30a58f628bfe39e7c8ad39deb8c47177c01a56299a9c1960f9239d6beeea","tlsh":"abb1b95606a670184bb0dbe0ca1b5825f55bf6633b81c284f79c66885f735248373efc"}],"package_integrity":[{"filename":"dolyame-boxy-mobile-bnpl-popup-35.1.9.tgz","hashes":{"sha1":"fba96e8599510ca1ec55061c53215db2e6ba8220","sha512_sri":"sha512-yRmfRKe7au/2tkv3ltSXZIuQq9fi/QIqlHa1l4Qg2ps9rEci07DlWnRUsTrJllD4nR+f07jDmwPkBq3R3h6rEQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-popup/MAL-2026-13127.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-mobile-bnpl-popup/v/35.1.9"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015651","import_time":"2026-08-05T15:20:01.70350869Z","modified_time":"2026-08-05T15:19:05Z","sha256":"1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074","source":"amazon-inspector","versions":["35.1.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}