dolyame-boxy-independent-bnpl-open-api@20.8.9

Analysis

dolyame-boxy-independent-bnpl-open-api@20.8.9 is a trojanized multi-stage downloader. The package ships a decoy stub (index.js) that immediately loads _helpers.js, which fingerprints the host OS/architecture and downloads a binary payload from Cloudflare Workers C2 endpoints (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf102-baf[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev) via HTTPS GET to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe. If the HTTPS download fails, it falls back to DNS TXT steganography via c[.]tin[.]dl[.]well1[.]site, where TXT records encode the payload in base64 chunks. The downloaded binary is written to /var/tmp/.cache_* (Linux/macOS) or %TEMP%\dotnet_diag_*.exe (Windows) and spawned as a detached background process (cmd.exe /c start /b or /bin/sh -c "path &"). A rate-limiting stamp file at /tmp/.analytics_state or %TEMP%\analytics_state prevents re-execution within 20840 seconds. The package has no lifecycle hooks — the payload runs on require() via the main entry point.