{"id":"MAL-2026-13072","summary":"Malicious code in boxy-mmb-types (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80)\nindex.js unconditionally require()s _loader.js on module load. _loader.js reconstructs hostnames by joining split string fragments (evading static grep) to build endpoints under oob-worker.cf*.workers.dev with a DNS-TXT fallback via *.dl.wel1.ru, fetches a platform-specific native binary via https.get, writes it to /var/tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd /c start. A TTL marker gates re-execution. A bundled lib/telemetry.js (~81 KB) is not imported by any code path and functions as decoy content to make the package resemble a legitimate telemetry wrapper. The obfuscated hostname assembly, disguised filenames, no-op stderr writer, and DNS covert-channel fallback are attacker anti-analysis patterns paired with the drop-and-execute chain.\n","modified":"2026-08-05T15:52:09.501708459Z","published":"2026-08-05T14:26:54Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:43.63377062Z","modified_time":"2026-08-05T14:26:54Z","sha256":"f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80","source":"amazon-inspector","versions":["35.4.1"],"id":"IN-MAL-2026-015304"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-mmb-types/v/35.4.1"}],"affected":[{"package":{"name":"boxy-mmb-types","ecosystem":"npm","purl":"pkg:npm/boxy-mmb-types"},"versions":["35.4.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"5eb88e5dc9fd1ce3f57c44727bee87075d38b7c95295b1489468ec5907d0ea9f","tlsh":"95b1b79a056570184bb09bf486274415f66ff6633380c298fb9ca5985f7712883b2efc","path":"_loader.js"},{"path":"lib/telemetry.js","sha256":"ea2e9395ff01fec4c5269c71e695bf10658f4a640470be90396339d578ed9f08","tlsh":"43835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-mmb-types-35.4.1.tgz","hashes":{"sha1":"a174f803a34b1f2b677b267b217d146294de808d","sha512_sri":"sha512-ApluuI+H8KlStjoFlxfSi+xZEP+GBxE37h86puA0MOmlk0Z/5TKRESpojEs/3KBJWQ4/w4ynE3rcf0qqPN9W4A=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-mmb-types/MAL-2026-13072.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}