{"id":"MAL-2026-13062","summary":"Malicious code in boxy-maker-readiness (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14)\nOn require(), index.js loads _shim.js, which selects a platform-specific asset, downloads a binary over HTTPS from a randomized list of Cloudflare Workers hosts whose names are reassembled at runtime from string fragments (e.g. 'oob-work'+'er.cf102-ba'+'.workers.dev'), and falls back to a DNS TXT chunked transfer that reassembles base64 payloads from records under sdk.dl.wel1.ru when HTTPS is blocked. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmod'd 0755, and spawned detached via /bin/sh -c '\u003cpath\u003e &' or cmd.exe /c start /b, with.unref() to survive the parent process. bootstrap() honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and writes a.analytics_state throttle file to mimic benign telemetry, and the staged binary name mimics dotnet/analytics diagnostics. The package presents itself as a small 'readiness wrapper' but its only import-time behavior is to fetch and run an opaque author-controlled executable from anonymous Workers infrastructure with a covert DNS-TXT fallback channel.\n","modified":"2026-08-05T15:52:03.747735689Z","published":"2026-08-05T14:29:57Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:29:57Z","sha256":"47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14","source":"amazon-inspector","versions":["35.3.4"],"id":"IN-MAL-2026-015324","import_time":"2026-08-05T15:19:44.892801305Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-maker-readiness/v/35.3.4"}],"affected":[{"package":{"name":"boxy-maker-readiness","ecosystem":"npm","purl":"pkg:npm/boxy-maker-readiness"},"versions":["35.3.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-maker-readiness/MAL-2026-13062.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"93a1b85a1666700847b09be0cb1b5416f65bf6633780c2c5fb9ca5981f7712483b2efc","path":"_shim.js","sha256":"1ffe7d42d45e4d5be8e6c468ef1dd8136f5b5c84c4b43a6ab9d0f901288dcb0b"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-YvoAq7goEcPHGU2J2Ikh05WE++cR/gKcHPyEbgzm09KoJkGzyNwAPwfQXrz1AWseeM7Av3KncONwHqiMTL4Y+Q==","sha1":"6a84dcf3e7dc2960aaeac82d7d4176c38edf0659"},"filename":"boxy-maker-readiness-35.3.4.tgz"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}