MAL-2026-13031
Dashboard / Malicious Package / MAL-2026-13031
MAL-2026-13031
Summary: Malicious code in boxy-bus-providers (npm)
Details: Source: amazon-inspector (e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79) On require() of the package, index.js loads _compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS-TXT base64 fallback from *.dl.wel1.ru, writes the payload to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). C2 hostnames and dangerous API names are string-split and reassembled at runtime (e.g., ['oob-worker.cf102-baf.wor','kers.dev'].join(''), require('child_'+'process'), fs['chmod'+'Sync']) to evade static detection. A sibling module lib/telemetry.js contains an identical fetch-decode-chmod-exec chain with a base64-reassembled payload delivered over DNS, staged as a secondary/updater dropper. The declared package purpose does not require downloading and executing an unpinned remote binary from anonymous workers.dev infrastructure.
Affected packages
Package
Name: boxy-bus-providers
Purl: pkg:npm/boxy-bus-providers
Affected ranges
Type: N/A
Events:
