Malicious code in dolyame-boxy-independent-bnpl-faq (npm)
The npm package dolyame-boxy-independent-bnpl-faq contains malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers and DNS-based infrastructure upon package require. The package masquerades as a BNPL FAQ utility but performs unauthorized binary execution.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of dolyame-boxy-independent-bnpl-faq
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-boxy-independent-bnpl-faqnpm package containing malicious code
The npm package dolyame-boxy-independent-bnpl-faq was found to contain malicious code that executes on package import. The index.js file loads runtime.js, which selects a platform-specific binary path and downloads an opaque payload from attacker-controlled infrastructure.\n\nThe malicious payload is fetched from Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback mechanism that reconstructs a base64-encoded payload from numbered subdomains of *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched binary is written to /var/tmp/.cache on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, made executable (chmod 0755), and spawned detached via /bin/sh -c or cmd.exe.\n\nThe package uses obfuscation techniques including string-array obfuscation and runtime hostname assembly via array-join to evade static analysis. Execution is gated by a TTL cache and can be disabled via environment variables. The stated purpose of the package (BNPL FAQ functionality) bears no relationship to the actual behavior of downloading and executing native binaries from anonymous worker hosts.\n\nThe incident was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-13551.
Indicators of compromise
- Packages
- dolyame-boxy-independent-bnpl-faq
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall dolyame-boxy-independent-bnpl-faq from all environments
- Audit package.json and lock files for any direct or transitive dependencies on dolyame-boxy-independent-bnpl-faq
- Review system logs and process execution history for suspicious binary execution from /var/tmp/.cache_ or %TEMP%\dotnet_diag_.exe
- Monitor for outbound connections to the identified malicious domains (Cloudflare Workers hosts and *.dl.wel1.ru)
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Use npm audit to identify and remediate any other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-p8v6-j29q-4m26 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-boxy-independent-bnpl-faq (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-boxy-independent-bnpl-faq-npm-1fx24p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package