Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98) On require of the package, index.js loads _loader.js which reconstructs attacker-controlled hostnames via string-split.join('') to evade scanners (mirrors of the form oob-worker.cf10{0,1,2}-{baf,adf}.workers.dev and DNS TXT fallback domains under wel1.ru such as sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), selects a platform/arch-specific asset, downloads a binary from one of the anonymous Cloudflare Workers hosts (with a DNS-over-TXT fallback that base64-reassembles bytes from <n>.<domain> TXT records), writes it to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawns it detached via /bin/sh -c or cmd.exe. A marker file named.analytics_state and comments referring to 'opt-out environment variables' present a telemetry cover story. There is no hash or signature verification on the downloaded bytes, the destinations are anonymous hosts unrelated to any legitimate publisher, and the package name itself is a lookalike combining unrelated brand/technology tokens. ## Source: ghsa-malware (2e59b1d946c38b9a6e256cc86700987daaf2338dba0e56b59a124da3e582af25) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
This threat involves a malicious npm package named dolyame-boxy-atom-bnpl-dangerously-html at version 35.5.4. Upon requiring the package, it loads a loader script that reconstructs attacker-controlled hostnames using string manipulation to evade scanners. It then downloads a platform- and architecture-specific binary from anonymous Cloudflare Workers hosts, with a DNS TXT record fallback mechanism that base64 reassembles the binary data. The binary is saved to temporary directories on Unix or Windows systems, given executable permissions, and executed detached from the main process. The package includes a telemetry cover story referencing opt-out environment variables, but no integrity checks such as hash or signature verification are performed on the downloaded binary. The package name itself is suspicious, combining unrelated brand and technology tokens to appear legitimate.
Potential Impact
The malicious package can execute arbitrary binaries on affected systems without integrity verification, potentially leading to unauthorized code execution. This can compromise system security by running attacker-controlled code with the privileges of the user executing the package. The evasion techniques and anonymous hosting increase the difficulty of detection and attribution.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or using the affected package version 35.5.4. It is recommended to remove the package if already installed and to verify dependencies for similar malicious packages. Monitor for suspicious network activity related to the described domains and binaries. Check vendor advisories or trusted security sources for updates on remediation.
Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98) On require of the package, index.js loads _loader.js which reconstructs attacker-controlled hostnames via string-split.join('') to evade scanners (mirrors of the form oob-worker.cf10{0,1,2}-{baf,adf}.workers.dev and DNS TXT fallback domains under wel1.ru such as sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), selects a platform/arch-specific asset, downloads a binary from one of the anonymous Cloudflare Workers hosts (with a DNS-over-TXT fallback that base64-reassembles bytes from <n>.<domain> TXT records), writes it to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawns it detached via /bin/sh -c or cmd.exe. A marker file named.analytics_state and comments referring to 'opt-out environment variables' present a telemetry cover story. There is no hash or signature verification on the downloaded bytes, the destinations are anonymous hosts unrelated to any legitimate publisher, and the package name itself is a lookalike combining unrelated brand/technology tokens. ## Source: ghsa-malware (2e59b1d946c38b9a6e256cc86700987daaf2338dba0e56b59a124da3e582af25) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a malicious npm package named dolyame-boxy-atom-bnpl-dangerously-html at version 35.5.4. Upon requiring the package, it loads a loader script that reconstructs attacker-controlled hostnames using string manipulation to evade scanners. It then downloads a platform- and architecture-specific binary from anonymous Cloudflare Workers hosts, with a DNS TXT record fallback mechanism that base64 reassembles the binary data. The binary is saved to temporary directories on Unix or Windows systems, given executable permissions, and executed detached from the main process. The package includes a telemetry cover story referencing opt-out environment variables, but no integrity checks such as hash or signature verification are performed on the downloaded binary. The package name itself is suspicious, combining unrelated brand and technology tokens to appear legitimate.
Potential Impact
The malicious package can execute arbitrary binaries on affected systems without integrity verification, potentially leading to unauthorized code execution. This can compromise system security by running attacker-controlled code with the privileges of the user executing the package. The evasion techniques and anonymous hosting increase the difficulty of detection and attribution.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or using the affected package version 35.5.4. It is recommended to remove the package if already installed and to verify dependencies for similar malicious packages. Monitor for suspicious network activity related to the described domains and binaries. Check vendor advisories or trusted security sources for updates on remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13285
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a73852fbf8831d5394f05e8
Added to database: 08/05/2026, 18:47:11 UTC
Last enriched: 08/05/2026, 21:47:23 UTC
Last updated: 09/07/2026, 22:29:18 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.