{"id":"MAL-2026-13055","summary":"Malicious code in boxy-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c)\nOn require('boxy-loader'), index.js loads _adapter.js which executes setup() at module top level. setup() picks a platform-specific remote path, downloads an opaque executable from obfuscated Cloudflare Workers hosts (hostnames such as oob-worker.cf*.workers.dev are assembled at runtime by joining split string fragments), writes it to /var/tmp/.cache_\u003chex\u003e on Unix or %TEMP%/dotnet_diag_\u003chex\u003e.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c '\u003cpath\u003e &' or cmd /c start. If the HTTPS fetch fails, loadViaDns() falls back to resolveTxt('c.\u003cdomain\u003e') to obtain a chunk count and then resolveTxt('\u003ci\u003e.\u003cdomain\u003e') against *.dl.wel1.ru, base64-decodes the concatenated TXT records, writes the resulting bytes to disk and executes them — a DNS-tunneled payload channel designed to survive HTTPS egress filtering. Both the CDN host list and the DNS discovery domains are constructed from split string fragments to hide destinations from string-matching scans. The fetched executable is not shipped in the tarball, is not pinned or hash-verified, and is unrelated to any documented package purpose; the staging filename decoys (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe) further conceal it.\n","modified":"2026-08-05T15:52:01.237590134Z","published":"2026-08-05T14:30:10Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.4.2"],"id":"IN-MAL-2026-015325","import_time":"2026-08-05T15:19:44.943838614Z","modified_time":"2026-08-05T14:30:10Z","sha256":"bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-loader/v/35.4.2"}],"affected":[{"package":{"name":"boxy-loader","ecosystem":"npm","purl":"pkg:npm/boxy-loader"},"versions":["35.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"f9547fc2b5b53747fecdb6e8733c5883fc5a8ee36e745b35e0b5590618e73f7d","tlsh":"d5a1b79a16a670184bb0a7e0c7075829f65af6633780c2d4f79c66845f735248272efc"}],"package_integrity":[{"filename":"boxy-loader-35.4.2.tgz","hashes":{"sha512_sri":"sha512-X/ClkxrXSKITdG1AsUQex4Je1b/g06WWRD1pNUqkW6QUBejtuEJj5Cu+RQOpZ6ZGUYpGMTYIgsy4OY3OcYt74A==","sha1":"482e5364aef347a274998d9f2484844716dc001b"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-loader/MAL-2026-13055.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}