MalwarePublished 5 Aug 2026

dolyame-boxy-mobile-bnpl-picture-gallery (npm) · Malicious Code

Affects dolyame-boxy-mobile-bnpl-picture-gallerySource GCVE Database

Malicious package : remove dolyame-boxy-mobile-bnpl-picture-gallery and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 20:44 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13126

What to do

Remove dolyame-boxy-mobile-bnpl-picture-gallery from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdolyame-boxy-mobile-bnpl-picture-gallery	Affected =35.2.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dolyame-boxy-mobile-bnpl-picture-gallery version 35.2.9 contains malicious code that downloads and executes a native binary from attacker-controlled servers. The package masquerades as a payments or BNPL gallery SDK but unconditionally loads a script that reconstructs command-and-control hostnames, downloads an opaque native payload, writes it to a hidden file, sets executable permissions, and executes it detached from the main process. This behavior results in arbitrary code execution on any host that installs or imports this package version.

Impact

This malicious package enables arbitrary native code execution on any system that installs or imports version 35.2.9 of dolyame-boxy-mobile-bnpl-picture-gallery. The attacker-controlled payload can run detached processes, potentially leading to full system compromise, persistence, and further malicious activities. The obfuscation and masquerading techniques increase the risk of unnoticed compromise in development or production environments using this package.

Defensive guidance

Users should immediately remove and avoid installing or importing dolyame-boxy-mobile-bnpl-picture-gallery version 35.2.9. Verify dependencies and supply chains for this package and replace it with trusted alternatives. Monitor for any signs of compromise related to this package and conduct incident response if it was installed.

Summary

The dolyame-boxy-mobile-bnpl-picture-gallery npm package version 35.2.9 includes a malicious script (_ext.js) that dynamically reconstructs C2 hostnames and downloads a native binary payload from these attacker-controlled endpoints. The payload is saved to a hidden temporary file with misleading names and executed with elevated permissions. The package uses obfuscation techniques such as string concatenation to hide its use of child_process and disguises the payload as .NET diagnostic or cache files. Additionally, a secondary dropper script (lib/telemetry.js) with similar capabilities is included in the package tarball but not invoked by the main entry point. The package falsely presents itself as a legitimate BNPL gallery SDK while performing unauthorized drop-and-execute operations, enabling remote code execution on any system that installs or requires this package.

References

npmjs.com/package/dolyame-boxy-mobile-bnpl-picture-gallery/v/35.2.9 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 20:44 UTC

Technical details

References

Community reviews