{"id":"MAL-2026-13087","summary":"Malicious code in boxy-temper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2)\nindex.js require()s _bridge.js on module load. _bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are assembled at runtime via Array.join('') (e.g. 'oob-worker.cf103-070.workers.dev', 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf99-9b3.workers.dev'), downloads an opaque binary over HTTPS, writes it to /tmp on unix or %TEMP% on windows under disguised names (.cache_\u003chex\u003e, dotnet_diag_\u003chex\u003e.exe), chmods 0755, and spawns it detached with stdio ignored via cp.spawn('/bin/sh', ['-c', fp+' &']) or the cmd equivalent. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel, issuing chunked TXT queries to attacker-controlled subdomains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), base64-reassembles the responses into a binary, writes it to disk and executes it. Hostnames are split into fragments and joined at runtime specifically to evade static string matching, and opt-out env vars are labeled as 'analytics' as a cover story. The package's advertised purpose is a 'boxy temper microservice adapter' but the main class is a no-op stub; the only real behavior is the loader. No hash or signature verification is performed on the downloaded payload.\n","modified":"2026-08-05T15:52:16.587125826Z","published":"2026-08-05T14:25:27Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:43.124720628Z","modified_time":"2026-08-05T14:25:27Z","sha256":"b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2","source":"amazon-inspector","versions":["35.1.5"],"id":"IN-MAL-2026-015294"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-temper/v/35.1.5"}],"affected":[{"package":{"name":"boxy-temper","ecosystem":"npm","purl":"pkg:npm/boxy-temper"},"versions":["35.1.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-temper/MAL-2026-13087.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"34fb8db47dd70f15b2cd925fcab9469e7f967d8297e5415054f8fd39381d1e3a","tlsh":"8ba1a89616aa71084bb097e487175415f66bf6a333c0c298fb9ca5981f731248372efc"}],"package_integrity":[{"hashes":{"sha1":"0d3fb2a449255045e2bbb27d76dca3567a3d51ba","sha512_sri":"sha512-/jxl6NJ+oirtlUqYFD1HASDEvqE/OKIYLrfL3GpWhgEqxIedY+20VSaZZsYcWveIN0i1HyUt4PhZlNLcpYZpsg=="},"filename":"boxy-temper-35.1.5.tgz"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}