{"id":"MAL-2026-13098","summary":"Malicious code in boxy-wrapper-rspack-plugin (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c)\nThe package advertises itself as an rspack plugin but ships a stub index.js that silently require()s _adapter.js, which runs at module load time. _adapter.js constructs Cloudflare Workers hostnames via string-array joins (e.g. 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf101-adf.workers.dev', 'oob-worker.cf99-9b3.workers.dev', 'oob-worker.cf102-baf.workers.dev'), downloads a platform-specific binary over HTTPS, writes it to a temp directory under a disguising filename (dotnet_diag_*.exe /.cache_*), chmods it 0o755, and spawns it detached via child_process. If the HTTPS fetch fails, loadViaDns() queries TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-reassembles the chunked TXT payload into an executable buffer, and executes it the same way. Environment flags such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK and a /tmp/.analytics_state cache file provide a telemetry-style cover story. The exported plugin class is a non-functional stub; the only effect of importing this package is the drop-and-execute of attacker-controlled code.\n","modified":"2026-08-05T15:52:21.588291223Z","published":"2026-08-05T14:22:49Z","database_specific":{"malicious-packages-origins":[{"versions":["35.8.3"],"id":"IN-MAL-2026-015278","import_time":"2026-08-05T15:19:42.172055692Z","modified_time":"2026-08-05T14:22:49Z","sha256":"67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-wrapper-rspack-plugin/v/35.8.3"}],"affected":[{"package":{"name":"boxy-wrapper-rspack-plugin","ecosystem":"npm","purl":"pkg:npm/boxy-wrapper-rspack-plugin"},"versions":["35.8.3"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"boxy-wrapper-rspack-plugin-35.8.3.tgz","hashes":{"sha1":"88a995b645d95595235fc4f3df18dc0a8313a10b","sha512_sri":"sha512-1kPqMWGYWhm0qh2aDAlDbfA7mXLf7GAWALp5mw+NUpe5Qni1StsCjjIAaijEd6/l8kh6+1UbzyhrquEXobg2Qg=="}}],"evidence_files":[{"tlsh":"68b1a79606a670198bb0d7e4c717581af65bf6633780d2c4fa5ca9980f72124c3b2efc","path":"_adapter.js","sha256":"10da118ce2ae48b64914758afd00be8501c21d34a628e9808c6b2da39522b8fb"},{"tlsh":"9ff04c8550eeb42382b0a3fadb224082f5b685350e57925cbb9850ef0fa0814039ceba","path":"index.js","sha256":"5225d402fcacff85b3c110fe036c5aa1295b757c59e7e907a72f2674b1b8a16a"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-wrapper-rspack-plugin/MAL-2026-13098.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}