Malicious code in dolyame-boxy-independent-bnpl-picture-gallery (npm)

The npm package dolyame-boxy-independent-bnpl-picture-gallery was found to contain malicious code in its index.js file. Upon require, the package unconditionally loads _bootstrap.js, which implements a multi-stage payload delivery mechanism.

The malicious code selects a platform-specific endpoint and downloads an opaque binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev). If the primary delivery fails, it falls back to DNS-TXT record chunking across numbered subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, reassembling base64-encoded content at runtime.

The fetched binary is written to /var/tmp/.cache_ (POSIX) or %TEMP%/dotnet_diag_.exe (Windows), made executable, and spawned detached via shell commands. Destination hostnames are assembled from fragmented arrays at runtime to evade static analysis. The payload is gated behind environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) as a cover story.

The package's advertised purpose—a picture-gallery or BNPL payment support module—has no legitimate need for downloading and executing native binaries from anonymous edge-worker hosts with no version pinning, publisher control, or cryptographic verification.