MAL-2026-13030

    Dashboard / Malicious Package / MAL-2026-13030

    MAL-2026-13030

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-add-script (npm)

    Details: Source: amazon-inspector (85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952) On require('boxy-add-script'), index.js loads _polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments (oob-worker.cf103-070.workers.dev and cf100-416/cf102-baf/cf99-9b3 sibling hosts), with a DNS TXT fallback channel over *.dl.wel1.ru that reassembles a base64 payload. _polyfill.js downloads a platform-specific binary over https, writes it to /var/tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and executable path fragments are split into arrays and joined at runtime to evade static inspection. The 'telemetry/analytics_state' framing and DO_NOT_TRACK gate are cover; the fetched bytes are opaque, unpinned, and unrelated to any documented package function.

    References: https://www.npmjs.com/package/boxy-add-script/v/35.2.2

    Affected packages

    Package

    Name: boxy-add-script

    Purl: pkg:npm/boxy-add-script

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.2