{"id":"MAL-2026-13045","summary":"Malicious code in boxy-fixture-paperclip (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (78a47f722fb30af7936e07182fa5fb42ecfd7efbacadd970a148a8a7daefc8e2)\nOn any require/import, index.js loads _adapter.js, which selects a platform-specific asset and downloads an opaque binary from a rotating set of Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev). The hostnames are reassembled at runtime via array-join to defeat static string extraction. The downloaded bytes are written to a hidden dot-file under /var/tmp (POSIX) or %TEMP% (Windows), chmod 0755'd, and executed detached via spawn('/bin/sh', ['-c',...]) or spawn('cmd',...). A DNS-TXT covert channel under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru provides a fallback that chunk-reassembles a base64 payload from TXT records when the primary hosts are unreachable. The tarball also ships lib/telemetry.js, an ~81 KB parallel dropper module masquerading as a Sentry-like analytics SDK that is not referenced in this version but duplicates the _adapter.js payload-staging shape. Installing or importing this package results in execution of attacker-controlled code on the installer's machine.\n","modified":"2026-08-05T15:51:56.294912924Z","published":"2026-08-05T14:31:24Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:45.452962161Z","modified_time":"2026-08-05T14:31:24Z","sha256":"78a47f722fb30af7936e07182fa5fb42ecfd7efbacadd970a148a8a7daefc8e2","source":"amazon-inspector","versions":["35.8.2"],"id":"IN-MAL-2026-015334"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-fixture-paperclip/v/35.8.2"}],"affected":[{"package":{"name":"boxy-fixture-paperclip","ecosystem":"npm","purl":"pkg:npm/boxy-fixture-paperclip"},"versions":["35.8.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"35e70e3ef64ea37773f0fc54c3e5ae14fba74b99c7501a44609ed5318f639878","tlsh":"f4b1b69a15a770188bb0dbe0c3175416f25ae2633381c198f75c99d81fb756883b2efc","path":"_adapter.js"},{"path":"lib/telemetry.js","sha256":"6de13e23867a95f37b5e1f63b7177edfeeae4318f08d23ce94543d3005e06220","tlsh":"93835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-fixture-paperclip-35.8.2.tgz","hashes":{"sha1":"3a98c96dba78c605c3dee39df89be0ee78e05cc1","sha512_sri":"sha512-DX8dXHHoIP4cRpQaAvbKau11bW0dHihVy3JEualX8fB66KgN+9PoxeMkyTbHdiFm3yeytevsYarGt2c3vtYySw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-fixture-paperclip/MAL-2026-13045.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}