dolyame-boxy-atom-bnpl-email-form@20.3.3

Analysis

When required, the package silently downloads and executes a second-stage binary payload from attacker-controlled infrastructure. The code in _runtime.js connects to Cloudflare Workers C2 domains (oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf99-9b3[.]workers[.]dev) over HTTPS to fetch a platform-specific binary (linux_x64, linux_arm64, darwin, win32). If the HTTPS download fails, it falls back to DNS TXT record-based data exfiltration via c[.]tin[.]dl[.]well1[.]site (DNS tunneling). The downloaded payload is written to /var/tmp/.cache_<random_hex> (or C:\Windows\Temp\dotnet_diag_<random_hex>.exe on Windows) and spawned as a detached background process. A cache marker at /tmp/.analytics_state prevents re-downloading within ~6 hours. The package has no repository, no lifecycle scripts, and its index.js exports a benign-looking class that silently loads the downloader.