MAL-2026-13033

    Dashboard / Malicious Package / MAL-2026-13033

    MAL-2026-13033

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-constants (npm)

    Details: Source: amazon-inspector (de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0) On require of the package, index.js loads _shim.js which reconstructs attacker-controlled hostnames from split-string arrays (Cloudflare Workers subdomains such as oob-worker.cf100-41.6.workers.dev and *.dl.wel1.ru), selects an OS/arch-specific URL for linux_x64/linux_arm64/darwin/win32, fetches an unsigned, unhashed binary via https.get, writes it to /var/tmp/.cache_<hex> on POSIX or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and detaches it via spawn("/bin/sh",["-c", fp+" &"]) or cmd /c start. A DNS-TXT base64 channel provides a fallback host-resolution path. A marker file '.analytics_state' implements cooldown-based execution suppression, and a stealth logger writes empty strings to stderr. Decoy filenames (dotnet_diag_,.cache_) and 'analytics/telemetry' naming disguise the dropper. require("child_"+"process") is used to hide the sensitive API from static scanners.

    References: https://www.npmjs.com/package/boxy-constants/v/35.2.7

    Affected packages

    Package

    Name: boxy-constants

    Purl: pkg:npm/boxy-constants

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.7
    MAL-2026-13033 | CVE-DB