MAL-2026-13038

    Dashboard / Malicious Package / MAL-2026-13038

    MAL-2026-13038

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-deps-calculator (npm)

    Details: Source: amazon-inspector (1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970) setup.js runs at install time: it performs an HTTPS reconnaissance request (https.get to a remote host with an identifier payload) and then spawns a platform-specific shell (spawn("/bin/sh") on POSIX, spawn("cmd") on Windows) via child_process. The file is invoked as an npm lifecycle script, giving the remote-directed shell execution on installer machines with no user interaction beyond `npm install`. The combination of an install-time outbound HTTP callout plus unconditional shell spawn is a dropper/backdoor shape rather than any documented build behavior, and the package name (a lookalike of common dependency-related utilities) has no legitimate purpose requiring shell execution during install.

    References: https://www.npmjs.com/package/boxy-deps-calculator/v/35.9.5

    Affected packages

    Package

    Name: boxy-deps-calculator

    Purl: pkg:npm/boxy-deps-calculator

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.5
    MAL-2026-13038 | CVE-DB