Threats Tagged 'mal-2026-12363'

The npm package dolyame-boxy-atom-bnpl-email-form version 20.3.3 contains malicious code that side-loads a runtime script to fetch and execute a binary payload from obfuscated Cloudflare Workers hosts. The payload is written to temporary directories with disguised filenames, given executable permissions, and spawned as a detached process. If the primary HTTPS fetch fails, the package uses a covert DNS TXT record channel to reconstruct and execute the payload. The package masquerades as an Analytics SDK with an opt-out telemetry feature, but this does not reflect its actual malicious behavior. There is no version pinning, hash verification, or signature validation, and the payload sources are not affiliated with the package publisher.