Hostile 100% javascript Download

dolyame-boxy-independent-bnpl-mobile-application 35.9.2

DNS C2, payload download, execution

Library import stages and detaches a fetched executablenpm entry import conceals a native payload sidecar
SHA-25681b9aa357b07b2078d5aee23e25d10ea74a1855cda7e0bcb0e8dcfa9b5a3a61a
URLhttps://registry.npmjs.org/dolyame-boxy-independent-bnpl-mobile-application/-/dolyame-boxy-independent-bnpl-mobile-application-35.9.2.tgz
MaleculeK₂(LiMc)O₃(CS₃As₂)H₆(Cm₁₀CrDb₉F₆Os₉Po₁₁)Md₂(InPa₃)

Also flagged by osv (MAL-2026-13321: Malicious code in dolyame-boxy-independent-bnpl-mobile-application (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.