{"id":"MAL-2026-13060","summary":"Malicious code in boxy-maker-legacy (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b)\nOn require of the package, _runtime.js runs a bootstrap routine that downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, cf100-416, cf103-070, cf101-adf), writes it to /tmp or %TEMP% under disguised names such as dotnet_diag_\u003chex\u003e.exe and.cache_\u003chex\u003e, chmod 0755, and detach-executes it via /bin/sh -c or cmd /c start. Destination hostnames are assembled at runtime by joining fragmented string arrays (e.g. [\"oob-worker\",\".cf99-\",\"9b3.\",\"work\",\"ers.\",\"dev\"].join(\"\")) to defeat static string matching. If HTTPS mirrors fail, the code walks DNS TXT records under *.dl.wel1.ru — first c.\u003cdomain\u003e for a chunk count, then 0.\u003cdomain\u003e, 1.\u003cdomain\u003e,... — concatenating base64 fragments to reconstruct the executable payload out-of-band. The package's stated purpose is a trivial BoxyMakerLegacy class with no legitimate need for platform-specific native binaries, remote binary fetches, throwaway workers.dev hosts, disguised staging filenames, or DNS-TXT payload delivery. The behavior fires automatically on import, giving whoever published the package arbitrary code execution on the installer's machine.\n","modified":"2026-08-05T15:52:03.393960139Z","published":"2026-08-05T14:29:40Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015322","import_time":"2026-08-05T15:19:44.78141784Z","modified_time":"2026-08-05T14:29:40Z","sha256":"fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b","source":"amazon-inspector","versions":["35.1.7"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-maker-legacy/v/35.1.7"}],"affected":[{"package":{"name":"boxy-maker-legacy","ecosystem":"npm","purl":"pkg:npm/boxy-maker-legacy"},"versions":["35.1.7"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"boxy-maker-legacy-35.1.7.tgz","hashes":{"sha1":"a2c12d9ce25651268c43ca2b56b9e54a190d8bae","sha512_sri":"sha512-eJ8Ir1zZOBi1TggAKOW5NIq4/2X80V30VYWG4yJ1y547piPIlzewzdEJzJdlod9dnSuOPR+2e4J5HF0/RwKPFA=="}}],"evidence_files":[{"tlsh":"bcb1b796027a70098bb0dbe5cb175416f66af6633780c588fb5ca9941f7602483f2efc","path":"_runtime.js","sha256":"4bdb9175a880cc1daf9c8bd76a4654ee2307e2db745482e3b5b28fb8edcac606"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-maker-legacy/MAL-2026-13060.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}