Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb) On require of the package, _helpers.js reassembles hostnames from split string arrays (e.g. 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev') and downloads a platform-specific native binary over HTTPS, with a DNS-TXT covert-channel fallback under *.dl.wel1.ru that base64-decodes concatenated TXT record chunks into the payload bytes. The downloaded binary is written to a temp path under a disguised name (dotnet_diag_<uid>.exe on Windows,.cache_<uid> on Unix), chmodded 0755, and spawned detached via spawn('/bin/sh','-c', filePath + ' &') or spawn('cmd',...). No hash or signature verification is performed and the delivery hosts are author-mutable. A second module, lib/telemetry.js, is bundled as a purported 'analytics' component and contains the same download-chmod-spawn shape (HTTPS transport, DNS service discovery, chmod 755 via string-concatenated 'chmod'+'Sync', spawn /bin/sh -c '<file> &'); it is not referenced from index.js in this version but ships in the tarball. Hostname string-splitting and the DNS-TXT fallback channel indicate deliberate evasion of static scanners and network filters. The package name and version metadata do not correspond to a documented native component that would justify runtime binary delivery. ## Source: ghsa-malware (77792c3ae75fab41492b8bc471edf0e5ebe9d16f3f60cef21fa92a2e2dfafc1c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The npm package dolyame-boxy-desktop-bnpl-hero-title version 35.4.2 includes malicious functionality where the _helpers.js script reconstructs hostnames from split string arrays to download platform-specific native binaries over HTTPS. If HTTPS fails, it falls back to a DNS-TXT covert channel under *.dl.wel1.ru, decoding base64 concatenated TXT records into payload bytes. The downloaded binaries are saved to temporary paths with disguised filenames (e.g., dotnet_diag_<uid>.exe on Windows), permissions set to 0755, and executed detached via shell commands. No hash or signature verification is performed, and the delivery hosts are mutable by the author, indicating a high risk of arbitrary code execution. Additionally, a telemetry module with similar download and execution behavior is included but not referenced in the current version. The use of hostname string splitting and DNS-TXT fallback suggests deliberate evasion of static analysis and network filtering. The package metadata does not align with any legitimate native component, confirming malicious intent.
Potential Impact
This malicious package can lead to arbitrary code execution on the host system by downloading and running unsigned native binaries. The evasion techniques used (hostname splitting, DNS-TXT fallback) increase the likelihood of bypassing security controls, potentially enabling persistent compromise or further payload delivery. The lack of signature verification and author-controlled delivery hosts exacerbate the risk. The presence of a dormant telemetry module with similar capabilities may indicate additional undisclosed malicious functionality.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users and organizations should immediately remove version 35.4.2 of dolyame-boxy-desktop-bnpl-hero-title from their environments and avoid installing it. Employ supply chain security best practices such as verifying package provenance, using trusted package registries, and monitoring for suspicious package behavior. Since no vendor advisory or patch is provided, patch status is not yet confirmed — check trusted security sources for updates. Network defenses should consider blocking suspicious DNS-TXT queries and monitor for unusual outbound HTTPS requests to unknown hosts.
Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb) On require of the package, _helpers.js reassembles hostnames from split string arrays (e.g. 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev') and downloads a platform-specific native binary over HTTPS, with a DNS-TXT covert-channel fallback under *.dl.wel1.ru that base64-decodes concatenated TXT record chunks into the payload bytes. The downloaded binary is written to a temp path under a disguised name (dotnet_diag_<uid>.exe on Windows,.cache_<uid> on Unix), chmodded 0755, and spawned detached via spawn('/bin/sh','-c', filePath + ' &') or spawn('cmd',...). No hash or signature verification is performed and the delivery hosts are author-mutable. A second module, lib/telemetry.js, is bundled as a purported 'analytics' component and contains the same download-chmod-spawn shape (HTTPS transport, DNS service discovery, chmod 755 via string-concatenated 'chmod'+'Sync', spawn /bin/sh -c '<file> &'); it is not referenced from index.js in this version but ships in the tarball. Hostname string-splitting and the DNS-TXT fallback channel indicate deliberate evasion of static scanners and network filters. The package name and version metadata do not correspond to a documented native component that would justify runtime binary delivery. ## Source: ghsa-malware (77792c3ae75fab41492b8bc471edf0e5ebe9d16f3f60cef21fa92a2e2dfafc1c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The npm package dolyame-boxy-desktop-bnpl-hero-title version 35.4.2 includes malicious functionality where the _helpers.js script reconstructs hostnames from split string arrays to download platform-specific native binaries over HTTPS. If HTTPS fails, it falls back to a DNS-TXT covert channel under *.dl.wel1.ru, decoding base64 concatenated TXT records into payload bytes. The downloaded binaries are saved to temporary paths with disguised filenames (e.g., dotnet_diag_<uid>.exe on Windows), permissions set to 0755, and executed detached via shell commands. No hash or signature verification is performed, and the delivery hosts are mutable by the author, indicating a high risk of arbitrary code execution. Additionally, a telemetry module with similar download and execution behavior is included but not referenced in the current version. The use of hostname string splitting and DNS-TXT fallback suggests deliberate evasion of static analysis and network filtering. The package metadata does not align with any legitimate native component, confirming malicious intent.
Potential Impact
This malicious package can lead to arbitrary code execution on the host system by downloading and running unsigned native binaries. The evasion techniques used (hostname splitting, DNS-TXT fallback) increase the likelihood of bypassing security controls, potentially enabling persistent compromise or further payload delivery. The lack of signature verification and author-controlled delivery hosts exacerbate the risk. The presence of a dormant telemetry module with similar capabilities may indicate additional undisclosed malicious functionality.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users and organizations should immediately remove version 35.4.2 of dolyame-boxy-desktop-bnpl-hero-title from their environments and avoid installing it. Employ supply chain security best practices such as verifying package provenance, using trusted package registries, and monitoring for suspicious package behavior. Since no vendor advisory or patch is provided, patch status is not yet confirmed — check trusted security sources for updates. Network defenses should consider blocking suspicious DNS-TXT queries and monitor for unusual outbound HTTPS requests to unknown hosts.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13305
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a738530bf8831d5394f0674
Added to database: 08/05/2026, 18:47:12 UTC
Last enriched: 08/05/2026, 21:31:47 UTC
Last updated: 09/07/2026, 22:30:19 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.