{"id":"MAL-2026-13052","summary":"Malicious code in boxy-lcd (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60)\nThe package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and additional hosts under dl.wel1.ru (sdk./ext./pkg./net.), with a DNS-TXT base64 fallback channel. The fetched bytes are written to a hidden temp path with masquerading names such as.cache_\u003chex\u003e and dotnet_diag_\u003chex\u003e.exe, chmod 0755, and spawned detached via /bin/sh or cmd. Network destinations and the child_process require string are assembled at runtime from split literals to evade static analysis; the exported BoxyLcd class is a non-functional stub, and opt-out env vars are named to resemble legitimate telemetry (analytics_state, DISABLE_TELEMETRY). Any consumer that installs or requires boxy-lcd triggers download-and-execute of an opaque, author-controlled binary on the installer's host.\n","modified":"2026-08-05T15:51:59.829190712Z","published":"2026-08-05T14:30:45Z","database_specific":{"malicious-packages-origins":[{"sha256":"85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60","source":"amazon-inspector","versions":["35.2.3"],"id":"IN-MAL-2026-015329","import_time":"2026-08-05T15:19:45.18750128Z","modified_time":"2026-08-05T14:30:45Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-lcd/v/35.2.3"}],"affected":[{"package":{"name":"boxy-lcd","ecosystem":"npm","purl":"pkg:npm/boxy-lcd"},"versions":["35.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"boxy-lcd-35.2.3.tgz","hashes":{"sha1":"863402a557998d336e62cb24cc4695a6603dba84","sha512_sri":"sha512-JOSb/0npwajahQdGt3rBUlf76T3xA7Uwd7J8WtnX2+L8HxpyRy+j5qbcIzvTxNNDqY97c+AO78mdqDl3kjdjuQ=="}}],"evidence_files":[{"path":"setup.js","sha256":"16c09df44c7b804a08e581b1cdd0c7be0b4a1e976a8eb8df90b6d54f7c138624","tlsh":"07a1a65606a570184bb0ebe4c717981af55bf6633681c288fb5c65944f7251483b2efc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-lcd/MAL-2026-13052.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}