Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)
The npm package dolyame-boxy-mobile-bnpl-footer contains malicious code that downloads and executes platform-specific binaries from attacker-controlled endpoints at import time. The package masquerades as a payment/BNPL footer component but performs arbitrary code execution via obfuscated child process spawning.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of dolyame-boxy-mobile-bnpl-footer; runtime execution of arbitrary platform-specific binaries during package import.
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-boxy-mobile-bnpl-footernpm package containing malicious code in index.js and lib/telemetry.js
The npm package dolyame-boxy-mobile-bnpl-footer contains embedded malicious code designed to download and execute arbitrary binaries at runtime. The attack is implemented in two locations: the main entry point (index.js) and a telemetry module (lib/telemetry.js).
Upon import, the package's index.js requires a module that fetches platform-specific executables from author-controlled Cloudflare Workers endpoints (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev). If these fail, it reconstructs a base64 payload from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded binary is selected based on platform (Linux x64, macOS, or Windows) and written to a decoy path (/tmp/.cache_ on Unix or TEMP/dotnet_diag_.exe on Windows) before being executed.
The lib/telemetry.js module implements the same attack primitive using obfuscation techniques: child_process is acquired via string concatenation (require("child_"+"process")), file permissions are set via property access (fs["chmod"+"Sync"]), and payloads are reassembled from base64 chunks. Hostnames, function names, and file paths are constructed at call time to evade static analysis.
The package presents itself as a payment/BNPL footer component, which does not match its actual malicious functionality. This is a classic supply chain attack using a deceptive package name to gain trust and distribution.
Indicators of compromise
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Remove dolyame-boxy-mobile-bnpl-footer from all projects immediately.
- Audit npm package.json and lock files for any presence of this package or similar suspicious packages.
- Assume any system that installed this package may be compromised; review process execution logs and network connections for suspicious activity.
- Regenerate any credentials or signing keys that may have been exposed on affected systems.
- Monitor for outbound connections to the identified malicious domains (oob-worker.cf*.workers.dev, *.dl.wel1.ru).
- Use npm audit and supply chain security tools to detect similar obfuscated malicious packages.
- Consider using package allow-lists and integrity verification in your dependency management.
Sources
- GitHub Advisory GHSA-7x39-v22m-pvhw · GitHub Advisory Database
Cite this entry
"Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-dolyame-boxy-mobile-bnpl-footer-npm-jnwzl8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit