dolyame-boxy-mobile-bnpl-popup@35.1.9

Analysis

The package is a stub "mobile SDK" whose index.js loads a bundled dropper (_loader.js) on require. The dropper builds obfuscated C2 hostnames (oob-worker[.]cf1-02-baf[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) and DNS domains (sdk[.]dl[.]wel1[.]ru, ext[.]dl[.]wel1[.]ru, pkg[.]dl[.]wel1[.]ru, net[.]dl[.]wel1[.]ru), downloads a platform-specific binary payload over HTTPS, and falls back to a DNS TXT-record chunked base64 channel when HTTP fails. It writes the downloaded payload to a hidden temp file (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows) and executes it as a detached background process with stdio ignored. A filesystem stamp in /tmp or %TEMP% limits re-execution to once per ~6 hours.