dolyame-boxy-independent-bnpl-table (npm) · Malicious Code
Affects dolyame-boxy-independent-bnpl-tableSource GCVE Database
Malicious package : remove dolyame-boxy-independent-bnpl-table and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 20:45 UTC
Malicious package
Published to npm · OSV MAL-2026-13331
What to do
Remove dolyame-boxy-independent-bnpl-table from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmdolyame-boxy-independent-bnpl-table | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package dolyame-boxy-independent-bnpl-table version 35.3.4 contains malicious code that, upon require(), downloads and executes an obfuscated platform-specific binary payload. The payload is fetched from dynamically assembled Cloudflare Workers hostnames with a DNS-TXT fallback resolver, saved to temporary directories under disguised names, permissioned for execution, and spawned detached. The package masquerades as an analytics SDK, honoring environment variables to disable telemetry as a cover story. A second bundled module exhibits similar malicious behavior with additional obfuscation. The package name and framing do not correspond to the observed malicious activity.