MAL-2026-13333
Dashboard / Malicious Package / MAL-2026-13333
MAL-2026-13333
Summary: Malicious code in dolyame-boxy-independent-bnpl-tiles (npm)
Details: Source: amazon-inspector (4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5) On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and joining them (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), fetches an opaque platform-specific binary over HTTPS from those hosts, writes it to a disguised temp path (names like.cache_* and dotnet_diag_*.exe), sets the executable bit via fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) (with a cmd branch for Windows). A base64-over-DNS-TXT fallback channel is implemented against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reading a chunk count from c.<domain> and reassembling base64 TXT chunks into the payload. No native source is shipped that would justify a binary download, and the destinations are unrelated to any declared publisher. A second module lib/telemetry.js is not reached from main in this version but contains the same fetch/chmod/spawn dropper pattern.
Affected packages
Package
Name: dolyame-boxy-independent-bnpl-tiles
Purl: pkg:npm/dolyame-boxy-independent-bnpl-tiles
Affected ranges
Type: N/A
Events:
