{"id":"MAL-2026-13031","summary":"Malicious code in boxy-bus-providers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79)\nOn require() of the package, index.js loads _compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS-TXT base64 fallback from *.dl.wel1.ru, writes the payload to /tmp or %TEMP% under disguised names (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). C2 hostnames and dangerous API names are string-split and reassembled at runtime (e.g., ['oob-worker.cf102-baf.wor','kers.dev'].join(''), require('child_'+'process'), fs['chmod'+'Sync']) to evade static detection. A sibling module lib/telemetry.js contains an identical fetch-decode-chmod-exec chain with a base64-reassembled payload delivered over DNS, staged as a secondary/updater dropper. The declared package purpose does not require downloading and executing an unpinned remote binary from anonymous workers.dev infrastructure.\n","modified":"2026-08-05T15:51:50.854764802Z","published":"2026-08-05T14:34:40Z","database_specific":{"malicious-packages-origins":[{"sha256":"e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79","source":"amazon-inspector","versions":["35.3.4"],"id":"IN-MAL-2026-015356","import_time":"2026-08-05T15:19:46.819802096Z","modified_time":"2026-08-05T14:34:40Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-bus-providers/v/35.3.4"}],"affected":[{"package":{"name":"boxy-bus-providers","ecosystem":"npm","purl":"pkg:npm/boxy-bus-providers"},"versions":["35.3.4"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"boxy-bus-providers-35.3.4.tgz","hashes":{"sha1":"89f963cea7ae7e85c93ea8edb157a8b7db73704e","sha512_sri":"sha512-TWWs+08cisNpNWjjBAE93BtGZg9iIfIRkbV+CqTqfMUKD2as2MN6cjLnIXLyL+u5fvHtKoxK8xFyKJzX1yHtgQ=="}}],"evidence_files":[{"tlsh":"cfa1985a156a70198bb0ebf48717441af65bfa633780c284fb5c69985f7212483b3dfc","path":"_compat.js","sha256":"d6538b0b356c888d991270a1822c242712b55e6eea7d04b55b2f4e89084e3e3d"},{"tlsh":"eb835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"c9977e089313cec9a769971466486e55793e60a250782ce998032fabf14826ff"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-bus-providers/MAL-2026-13031.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}