MAL-2026-13330 Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from array-fragment string joins (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev) to defeat literal-string scanning, downloads a per-platform binary payload, writes it to /tmp as a hidden dotfile on Unix or to the Windows temp directory as dotnet_diag_*.exe, sets mode 0755, and spawns it detached via /bin/sh -c or cmd.exe. When HTTPS delivery fails, it falls back to a DNS TXT covert channel against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru: it reads a record count from c.<domain> and reassembles base64-encoded binary bytes from numbered TXT records. The fetched code is unpinned, unsigned, and unrelated to the package's declared BNPL swagger purpose. A separate lib/telemetry.js bundles the same drop-and-exec primitives (fs["chmod"+"Sync"], cp.spawn("/bin/sh", ["-c", filePath+" &"])) using bracket-string reconstruction; it is not reachable from the current main entrypoint but is staged in the tarball.