Malicious code in dolyame-boxy-mobile-bnpl-button-set (npm)

The npm package dolyame-boxy-mobile-bnpl-button-set was found to contain malicious code that executes on require. The package's index.js loads shim.js, which fetches platform-specific payloads from attacker-controlled endpoints including Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) and DNS-TXT records under domains including sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru.\n\nThe malicious code downloads opaque binary payloads without hash or signature verification, writes them to temporary directories (/tmp or %TEMP%) under decoy filenames (dotnet_diag.exe on Windows, .cache_ on Unix), sets executable permissions (0755), and spawns them detached via cmd.exe or /bin/sh. The attack is framed as telemetry collection, with environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) used as opt-out markers.\n\nA secondary dormant code path exists in lib/telemetry.js (81 KB) containing parallel download-write-chmod-spawn functionality with base64 payload reassembly, currently unreferenced. The declared purpose of the package—a BNPL button UI component—has no legitimate need for native binary execution, confirming the malicious intent.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-6qhp-2g9g-gg7g.