Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)

The npm package dolyame-boxy-mobile-bnpl-card-panel was found to contain malicious code in its bootstrap.js file. Upon require, the code downloads platform-specific binaries from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) and writes them to temporary directories (/var/tmp or %TEMP%) under disguised names such as dotnet_diag.exe or .cache_.

The malicious code employs obfuscation techniques to evade detection, including runtime assembly of destination hostnames from fragmented string arrays. When HTTPS mirrors fail, it falls back to a DNS-TXT covert channel against multiple domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), querying for chunk counts and retrieving base64-encoded payloads that are decoded and executed.

The package presents itself as a payment and device integration library, but its actual behavior is to fetch and execute opaque attacker-controlled binaries at load time. A TTL cache at /tmp/.analytics_state throttles re-execution, with opt-out available only through undocumented environment variables. The incident was identified by the OpenSSF malicious-packages project.