🛡️ MAL-2026-12364 — dolyame-boxy-atom-bnpl-store-button

Malicious code in dolyame-boxy-atom-bnpl-store-button (npm)

Source: amazon-inspector

On require, index.js loads _loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from split-string arrays (e.g. oob-worker.cf1XX-*.workers.dev), with a DNS-TXT chunked fallback resolving under *.dl.well1.site. The binary is written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmodded 0755, and detached-spawned via /bin/sh -c or cmd /c start /b (_loader.js line 121-127). Hostname strings are split across array literals joined at runtime, and comments frame the behavior as 'telemetry' with DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-outs as cover. A separate lib/telemetry.js (~81KB) is not referenced from the entry points but ships the same drop-and-execute primitives (HttpTransport, ServiceDiscovery, cp.spawn('/bin/sh',[ '-c', filePath+' &']), chmodSync 0755, base64 chunk buffering) as a redundant loader. The package name mimics a Russian BNPL merchant integration but its only observable effect on require is fetching and executing an unverified remote binary.