MAL-2026-13028
Dashboard / Malicious Package / MAL-2026-13028
MAL-2026-13028
Summary: Malicious code in boxy-adapter-tramvai (npm)
Details: Source: amazon-inspector (d20d5167abc8703b7b09a0d9698e6d0fd060f4378dfa11ab469af3e6805cfc8e) On library load, index.js requires./_runtime.js, which selects a platform-specific staging path, fetches an opaque binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT base64 fallback under *.dl.wel1.ru (sdk/ext/pkg/net subdomains), writes the bytes to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and detached-spawns via /bin/sh -c or cmd. Hostnames are reconstructed at runtime via Array.join fragments to evade static analysis; a cache marker file at /tmp/.analytics_state gates re-execution, and env vars named DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK are used as a telemetry cover story. The DNS-TXT channel reads a chunk count from c.<domain> then reassembles base64 fragments from 0.<domain>..N.<domain> into an executable buffer, providing a firewall-evading secondary delivery path. Payload bytes are unpinned, unverified, and staged under filenames impersonating OS diagnostic tools. The name mimics the legitimate @tramvai ecosystem.
Affected packages
Package
Name: boxy-adapter-tramvai
Purl: pkg:npm/boxy-adapter-tramvai
Affected ranges
Type: N/A
Events:
