Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)

The npm package dolyame-boxy-independent-bnpl-product-grid was found to contain malicious code in its index.js and runtime.js files. Upon require, the package selects a platform-specific payload path and attempts to download an opaque binary from multiple hardcoded command-and-control infrastructure points.\n\nThe malicious code uses several evasion techniques: Cloudflare Workers hosts are assembled by joining split string fragments to evade static scanners, with hostnames including oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf100-416.workers.dev. A fallback covert channel reassembles a base64-encoded payload across numbered DNS TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru.\n\nThe downloaded binary is written to temporary directories (/var/tmp on Unix or %TEMP% on Windows) under decoy filenames such as dotnet_diag.exe or .cache_, given execute permissions (0755), and spawned in detached mode via /bin/sh -c or cmd.exe /c start /b. A stamp file prevents repeated execution. The package name was chosen to impersonate a legitimate BNPL/e-commerce product identifier, likely to increase installation likelihood.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.