{"id":"MAL-2026-13036","summary":"Malicious code in boxy-debugger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2)\nboxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers _platform.js, which reconstructs attacker-controlled destinations from split string arrays (hosts under oob-worker.cf*.workers.dev and *.dl.wel1.ru), downloads a platform-specific native binary via https.get, writes it to /tmp or %TEMP% under cover-story names such as.cache_\u003chex\u003e and dotnet_diag_\u003chex\u003e.exe, chmods it to 0755, and spawns it detached through /bin/sh -c or cmd.exe /c start. A DNS-TXT chunked-base64 channel over *.dl.wel1.ru serves as a fallback delivery path, and a sibling module lib/telemetry.js carries parallel dropper logic (base64 payload assembly, spawn of /bin/sh -c, chmod 0755 via string-concatenated \"chmod\"+\"Sync\") staged as latent payload. Destinations are unpinned, unsigned, and obfuscated; the framing as telemetry/analytics does not match the actual behavior, which is full-host remote code execution against every environment that installs or imports the package.\n","modified":"2026-08-05T15:51:53.050028917Z","published":"2026-08-05T14:32:15Z","database_specific":{"malicious-packages-origins":[{"sha256":"0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2","source":"amazon-inspector","versions":["35.3.4"],"id":"IN-MAL-2026-015340","import_time":"2026-08-05T15:19:45.738278346Z","modified_time":"2026-08-05T14:32:15Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-debugger/v/35.3.4"}],"affected":[{"package":{"name":"boxy-debugger","ecosystem":"npm","purl":"pkg:npm/boxy-debugger"},"versions":["35.3.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-debugger/MAL-2026-13036.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"8f1a86fb82c5e650a822400a8c67232517ddd9a0b1a5712095a8cfead0623dfb","tlsh":"6eb1a69a016a71198bb0dbe487274426f66bf6633281c2c4f76c99845f73524c372dfc","path":"_platform.js"},{"tlsh":"05835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"4e830df92cc475368422d814729093a25c6456a6aa903eefa80ef4f56b1a76f9"}],"package_integrity":[{"filename":"boxy-debugger-35.3.4.tgz","hashes":{"sha1":"9277c70ec806344430a17f9fad5ca15be6a9d190","sha512_sri":"sha512-ldPF0VyFL3PJbyizexL3+khw3GSibpEmIv5gDldINqbMLlatAkKVSaxcGVDHVcmxI5Px80NudcSJXtHmf9LXQw=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}