{"id":"MAL-2026-15921","summary":"Malicious code in box-sign-client-poc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc47a8e8a147ec412ecc05d666655b675a36b9eec0823e278767a286993e7e0d)\npackage.json declares a preinstall hook that runs index.js on `npm install`. The script reads the installer's hostname and OS username, embeds them together with a timestamp into a DNS subdomain of the form `poc-\u003chostname\u003e-\u003cuser\u003e-\u003ctimestamp\u003e.iv6mfybhp42k33ysmzi73de5w.canarytokens.com`, and issues a DNS resolution for that name, causing the installer's host and user identifiers to be transmitted to a third-party canarytokens.com collector at install time. The package name and framing indicate a dependency-confusion proof-of-concept targeting a Box-branded internal package, but the exfiltration primitive runs against any machine that installs it.\n","modified":"2026-09-04T07:00:08.516309250Z","published":"2026-09-04T06:38:27Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-04T06:38:27Z","sha256":"cc47a8e8a147ec412ecc05d666655b675a36b9eec0823e278767a286993e7e0d","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019639","import_time":"2026-09-04T06:53:31.765831636Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/box-sign-client-poc/v/1.0.0"}],"affected":[{"package":{"name":"box-sign-client-poc","ecosystem":"npm","purl":"pkg:npm/box-sign-client-poc"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/box-sign-client-poc/MAL-2026-15921.json","indicators":{"evidence_files":[{"tlsh":"4751ab9469fc40383577488a9497653ba86cefa23346fd20766c424a4ec3bb9d7131bf","path":"index.js","sha256":"8eaf5131b39e711e6f015ecf8012ee452011ba0094795496e5101e2dd8f7873b"}],"package_integrity":[{"filename":"box-sign-client-poc-1.0.0.tgz","hashes":{"sha1":"2fb186ba6143b2457b7b0e3c132a7b181c6735c2","sha512_sri":"sha512-6iAQRSwBY+F29P9EHaqAr0z8DOYCDz840SxVYZlbwGDQkyFUfEMv0Ij9kOaN7N8s/L8t+lr7L4wxJSEcmHLz/A=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}