{"id":"MAL-2026-13083","summary":"Malicious code in boxy-sitree (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc)\nRequiring boxy-sitree triggers _shim.js, which selects a platform-specific binary path, fetches an executable from Cloudflare Workers hosts assembled by joining string fragments (oob-worker.cf*-*.workers.dev) with a DNS-TXT covert channel fallback that reassembles base64 chunks from numbered subdomains of *.dl.wel1.ru, writes the bytes to a temp file, chmods 0755, and spawns the binary detached via /bin/sh -c '\u003cfile\u003e &' on Unix or cmd.exe start /b on Windows. Host and domain strings are split to defeat static matching, and the dropper is wrapped in analytics/diagnostics cover-story naming with opt-out environment variables. A second, unreferenced module lib/telemetry.js contains the same shell-spawn + chmod 0755 + base64 payload staging pattern under an 'Analytics SDK' framing, indicating a staged/parallel payload from the same actor. Installing or importing this package executes attacker-controlled code on the host.\n","modified":"2026-08-05T15:52:14.293400563Z","published":"2026-08-05T14:25:52Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:43.256611319Z","modified_time":"2026-08-05T14:25:52Z","sha256":"2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc","source":"amazon-inspector","versions":["35.8.7"],"id":"IN-MAL-2026-015297"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-sitree/v/35.8.7"}],"affected":[{"package":{"name":"boxy-sitree","ecosystem":"npm","purl":"pkg:npm/boxy-sitree"},"versions":["35.8.7"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"9fbb3d5957f1e9f5330ac5a9cf6760995e2b938ccfd10c683d5757c3939a411b","tlsh":"a0a1889a16aa70194b70ebe4c6174415f65bf653338082d4f6ac69945fb3134c3b2efc","path":"_shim.js"},{"tlsh":"5c835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"684cb37dbae63d5388a841fe6167b5bf391dc1a6b712f9a032912c3c319e2263"}],"package_integrity":[{"hashes":{"sha1":"cc93ed937eeabd5d84d4df847bed9f71797bcc75","sha512_sri":"sha512-acZMHofo6kIQr4xMuD0Z+QhtPJEejchag+f2pQNMrb9HixV2bl8GY9gweV5unNRPX8AlyF+pUGfoRoHl81t3KQ=="},"filename":"boxy-sitree-35.8.7.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-sitree/MAL-2026-13083.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}