Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)
The npm package dolyame-boxy-independent-bnpl-preset-container contained malicious code that downloads and executes arbitrary binary payloads from attacker-controlled infrastructure. The dropper executes at module require time, making any installation of the package immediately vulnerable.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed the malicious package version
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-boxy-independent-bnpl-preset-containernpm package containing malicious code
The npm package dolyame-boxy-independent-bnpl-preset-container was found to contain malicious code in its index.js file. Upon module load, the code requires _platform.js, which reconstructs obfuscated hostnames (oob-worker.cf10*-*.workers.dev and sdk.dl.wel1.ru) to hide command-and-control destinations from static analysis.
The malicious code fetches an opaque binary payload via HTTPS from these attacker-controlled hosts, with a DNS-TXT chunked-base64 fallback mechanism. The downloaded payload is written to temporary directories (/var/tmp or %TEMP%) under randomized hidden filenames and executed with elevated permissions via shell commands (/bin/sh -c or cmd.exe).
No cryptographic verification of the fetched payload is performed. The package's advertised purpose is a BNPL (Buy Now Pay Later) preset container, but the actual functionality is a downloader and executor of arbitrary code. Fake telemetry opt-out markers (analytics_state, DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) provide cover for the malicious behavior.
The malicious code executes immediately upon require, meaning any application that installed this package was compromised at installation time.
Indicators of compromise
- Packages
- dolyame-boxy-independent-bnpl-preset-container
- Domains
- oob-worker.cf10-*.workers.dev
- sdk.dl.wel1.ru
- *.dl.wel1.ru
Remediation
- Immediately remove the dolyame-boxy-independent-bnpl-preset-container package from all projects
- Audit npm package-lock.json and yarn.lock files for any installations of this package
- Review application logs and system logs for evidence of unauthorized binary execution or network connections to the identified domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Consider the affected systems as potentially compromised and perform forensic analysis
- Block network traffic to the identified attacker domains at the firewall level
- Update to a clean version of any legitimate BNPL container package if needed
Sources
- GitHub Advisory GHSA-5g7g-5hwv-rrm7 · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-boxy-independent-bnpl-preset-container-npm-9e2rgh
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
npmCompromised packageTyposquatting - containedcritical
Malicious code in flydev (npm)
The npm package flydev contains malicious code designed to destroy Windows systems. The package masquerades as a utility but executes destructive operations including filesystem deletion, process termination, memory exhaustion, and fork bombs when invoked.
npmCompromised package - resolvedcritical
Malicious code in ranux-dev (npm)
ranux-dev, an npm package, contained malicious code that substituted a popular WhatsApp library dependency with arbitrary code from an unaffiliated GitHub account. The package was heavily obfuscated and designed to harvest WhatsApp sessions and credentials from installers.
npmCompromised packageDependency confusion - containedcritical
Malicious code in npm-wold (npm)
npm-wold@1.1.1 contains malicious code in its postinstall script that fetches remote JSON from a hardcoded endpoint and dynamically invokes attacker-controlled functions with attacker-supplied arguments, enabling code execution at install time.
npmCompromised package