{"id":"MAL-2026-13029","summary":"Malicious code in boxy-add-link (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701)\nOn require('boxy-add-link'), index.js loads _compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), retrieves an opaque binary over https.get, writes it to /tmp/.cache_\u003chex\u003e on unix or %TEMP%\\dotnet_diag_\u003chex\u003e.exe on windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, the module reassembles a base64-encoded payload from sequential DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) and feeds the same write-chmod-spawn pipeline. Hostnames and API names (child_process, chmodSync) are constructed at runtime from split fragments to evade string scanning. A second, structurally identical dropper is staged in lib/telemetry.js but is not reachable from the main entry in this version.\n","modified":"2026-08-05T15:51:49.650522562Z","published":"2026-08-05T14:34:12Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015353","import_time":"2026-08-05T15:19:46.602914499Z","modified_time":"2026-08-05T14:34:12Z","sha256":"8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701","source":"amazon-inspector","versions":["35.7.5"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-add-link/v/35.7.5"}],"affected":[{"package":{"name":"boxy-add-link","ecosystem":"npm","purl":"pkg:npm/boxy-add-link"},"versions":["35.7.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-add-link/MAL-2026-13029.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"95a6918c7dff10b7eec7d8872658464e4d4798c8","sha512_sri":"sha512-/4w6HujPSo39wJ3uJpmCvqIg9fsZbLFd3yRqJmLvb3APRs/npKU7lU81BkEtZL5hakPn+PAQBBcFe+7rVd85mA=="},"filename":"boxy-add-link-35.7.5.tgz"}],"evidence_files":[{"tlsh":"50a1735a16a971184bb0abe4c717541af66bf2633781c294f79ca8941f7313483b2efc","path":"_compat.js","sha256":"1a9eb958d8edf30a34b094b4ef56d8ecccf1f1d1bcf6df2c5ddc4559c536187e"},{"sha256":"eb6d210b85718006203d01133b598cf7b4dbb14de3ce70482ca782309259cd35","tlsh":"c8835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}