Malicious code in dolyame-boxy-atom-bnpl-navigation-arrow (npm)

The npm package dolyame-boxy-atom-bnpl-navigation-arrow was found to contain malicious code in its index.js and bridge.js files. Upon require(), the package unconditionally executes a setup routine that attempts to download platform-specific executables from attacker-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). The hostnames are reconstructed at runtime using split string fragments to evade detection.\n\nThe downloaded binaries are written to temporary directories (/var/tmp on Unix, %TEMP% on Windows) under names mimicking legitimate artifacts (dotnet_diag.exe on Windows, .cache_ on Unix), made executable (chmod 0755), and launched detached via shell commands. When HTTPS retrieval fails, the malware falls back to a DNS-TXT covert channel, querying TXT records against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru to retrieve payload chunks, which are base64-decoded and executed.\n\nThe malware uses obfuscation techniques including splitting the child_process module name ("child_"+"process") to evade static analysis, and gates execution with a ~19958-second cooldown and environment variable checks (DISABLE_TELEMETRY, DO_NOT_TRACK). The package name and version pattern are consistent with a typosquat or dependency-confusion attack vector.