Malware in dolyame-boxy-atom-bnpl-image-card
Malware discovered in the npm package dolyame-boxy-atom-bnpl-image-card. Systems with this package installed are considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- dolyame-boxy-atom-bnpl-image-card
The npm package dolyame-boxy-atom-bnpl-image-card has been identified as containing malware. According to the GitHub Advisory (GHSA-x3cq-qwv4-jggj), any computer with this package installed or running should be considered fully compromised.\n\nThe advisory recommends immediate rotation of all secrets and keys from a different, unaffected computer. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the package installation, given the potential for full system compromise.\n\nUsers should treat any system that has had this package installed as potentially fully compromised and take appropriate incident response measures.
Indicators of compromise
- Packages
- dolyame-boxy-atom-bnpl-image-card
Remediation
- Immediately rotate all secrets, keys, and credentials from a different, unaffected computer
- Remove the dolyame-boxy-atom-bnpl-image-card package from all affected systems
- Conduct a full security audit and forensic analysis of any system that had this package installed
- Monitor affected systems for signs of unauthorized access or persistence mechanisms
- Consider rebuilding affected systems from clean media if full compromise is suspected
Sources
- GitHub Advisory GHSA-x3cq-qwv4-jggj · GitHub Advisory Database
Cite this entry
"Malware in dolyame-boxy-atom-bnpl-image-card." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malware-in-dolyame-boxy-atom-bnpl-image-card-900jrg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - containedcritical
Malware in svelte-goal-vim
Malware was discovered in the npm package svelte-goal-vim. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in kit-hydration-vim
The npm package kit-hydration-vim contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package