{"id":"MAL-2026-13336","summary":"Malicious code in dolyame-boxy-markdown (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6)\nOn require() of dolyame-boxy-markdown, index.js loads _ext.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT covert-channel fallback under *.dl.wel1.ru (sdk/ext/pkg/net subdomains). The fetched bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_\u003chex\u003e.exe,.cache_\u003chex\u003e), chmod 0755, then spawned detached via cmd.exe /c start /b on Windows or /bin/sh -c '\u003cpath\u003e &' on Unix. No hash or signature verification is performed. Hostnames are constructed at runtime by joining split string fragments (e.g. ['oob-w','orker.cf101-adf.w','orkers.de','v'].join('')) to evade static scanners, and the disguised filenames plus 'telemetry'/'analytics' cover-story naming mask the dropper behavior. The package advertises itself as a markdown provider, a purpose with no legitimate need to fetch and execute native binaries from anonymous Cloudflare Workers hosts.\n","modified":"2026-08-05T16:50:58.828592704Z","published":"2026-08-05T15:21:15Z","database_specific":{"malicious-packages-origins":[{"sha256":"373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6","source":"amazon-inspector","versions":["35.9.4"],"id":"IN-MAL-2026-015665","import_time":"2026-08-05T16:13:29.82592601Z","modified_time":"2026-08-05T15:21:15Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-markdown/v/35.9.4"}],"affected":[{"package":{"name":"dolyame-boxy-markdown","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-markdown"},"versions":["35.9.4"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-qRkjI/yNpW2VMnIVX7msgcJfKlyVNVNLJncwgyAH7Gvp1FJcUJxw1UMcgUm22xyB4zcQgiWsEN3Qa/bfEP0Dvw==","sha1":"4237e45a8e97d48b1949a020776090df4be03c43"},"filename":"dolyame-boxy-markdown-35.9.4.tgz"}],"evidence_files":[{"sha256":"6349fd14c4120b8eada80758cd43bd0b2d86829ea8b5a03608a919295acce751","tlsh":"69a1755a127a70198bb0a7f4871b441af65bf6633380c294fb6c64985f7752483b2dfc","path":"_ext.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-markdown/MAL-2026-13336.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}