{"id":"MAL-2026-13074","summary":"Malicious code in boxy-page-story (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6cb3184221c24b500fca09d9e96c886b1ffe703d60b121150180b2387a87c48d)\nOn require, index.js loads./_runtime, which reconstructs C2 hostnames from string-array concatenation to hide four oob-worker.cf1{00,01,02,03}-*.workers.dev endpoints and a wel1.ru DNS-TXT covert-channel fallback (chunk-count TXT at c.\u003cdomain\u003e, base64 chunks at \u003cn\u003e.\u003cdomain\u003e, reassembled and base64-decoded). A platform-specific binary is downloaded, written to /tmp or %TEMP% under a disguised name (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd.exe /c start /b. No hash or signature verification; hosts are attacker-controlled non-publisher infrastructure. Fetch is gated by absence of a recent cache file and DO_NOT_TRACK-style env vars. index.js wraps the require in try/catch to swallow errors silently.\n","modified":"2026-08-05T15:52:10.381718073Z","published":"2026-08-05T14:27:29Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:43.947838707Z","modified_time":"2026-08-05T14:27:29Z","sha256":"6cb3184221c24b500fca09d9e96c886b1ffe703d60b121150180b2387a87c48d","source":"amazon-inspector","versions":["35.8.5"],"id":"IN-MAL-2026-015308"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-page-story/v/35.8.5"}],"affected":[{"package":{"name":"boxy-page-story","ecosystem":"npm","purl":"pkg:npm/boxy-page-story"},"versions":["35.8.5"],"database_specific":{"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"964ae178ebd7a6b7b75f6f865867a51353ab6b523832e0e28d050703a300756c","tlsh":"45a16396166a710887b097e4c71b4416f55bf6a333c0d2d4fbaca5981fb312482b2efc"}],"package_integrity":[{"hashes":{"sha1":"f8d34e329e8b9de134f88ee69987bd8b35c37c80","sha512_sri":"sha512-n1bgnE4mF82NU6DhD/xeZu/NadqPU2IDr8xDHtdKpfZM/7+aJP72iqRMpjU6TNG9mbSaKhZipPzpp7T9HNX25Q=="},"filename":"boxy-page-story-35.8.5.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-page-story/MAL-2026-13074.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}