{"id":"MAL-2026-13078","summary":"Malicious code in boxy-rspack-optimize-sharing-runtime (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80)\nThe package's index.js unconditionally requires./_bridge on module load. _bridge.js selects a platform-specific payload path (linux_x64, linux_arm64, darwin, win32.exe), downloads bytes from a rotating list of *.workers.dev hosts whose hostnames are reconstructed by array-joining string fragments (e.g. ['oob-worker.cf100','-416.worke','rs','.de','v'].join('')), with a DNS-TXT fallback that reassembles a base64 payload from chunked TXT records under *.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache_\u003chex\u003e or %TEMP%\\dotnet_diag_\u003chex\u003e.exe, chmod 0755, then spawned detached via /bin/sh -c '\u003cpath\u003e &' or cmd.exe /c start /b. A second file lib/telemetry.js ships the same drop-and-exec primitives (base64 chunk reassembly, string-concatenated fs['chmod'+'Sync'], /bin/sh spawn) framed as an APM SDK, though it is not on the reachable graph from index.js. Filenames such as.cache_/.analytics_state/dotnet_diag_ and a DISABLE_TELEMETRY env check are cover framing; the endpoint reconstruction and DNS-TXT smuggling are not legitimate telemetry patterns. Any require/import of this package results in remote code execution on the host.\n","modified":"2026-08-05T15:52:11.855057336Z","published":"2026-08-05T14:25:44Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:43.200138471Z","modified_time":"2026-08-05T14:25:44Z","sha256":"be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80","source":"amazon-inspector","versions":["35.2.9"],"id":"IN-MAL-2026-015296"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-rspack-optimize-sharing-runtime/v/35.2.9"}],"affected":[{"package":{"name":"boxy-rspack-optimize-sharing-runtime","ecosystem":"npm","purl":"pkg:npm/boxy-rspack-optimize-sharing-runtime"},"versions":["35.2.9"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"6aa1969a0266701987b0d7e4c71b5416fa5be6633380c2d4fb5c99985f731648372efc","path":"_bridge.js","sha256":"baddb8a431544bab5d75cfe180548e661f843fb3dc6fb388b87a5a6bec7df92b"},{"path":"lib/telemetry.js","sha256":"6fdb87dc50f635a374257fbe89b45e3ac0bacbe2fb46391c348ecc3701c60bb2","tlsh":"01835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-rspack-optimize-sharing-runtime-35.2.9.tgz","hashes":{"sha1":"e10a695655b00f041b5afb20014430e0229db6b8","sha512_sri":"sha512-oHlHXDZy8xcedxuV/0iv8LwbS/l4bnb6OqtpjGHh+9GmcDARpPCKEJdZr+BF8UlFF0efqhMufiaSPeI1VEZXwQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-rspack-optimize-sharing-runtime/MAL-2026-13078.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}