MAL-2026-13039

    Dashboard / Malicious Package / MAL-2026-13039

    MAL-2026-13039

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-devtools (npm)

    Details: Source: amazon-inspector (44d0a7cd9dacffcb1188a7f6dfdde918d6ef5ba334e773f44330c93f4dd38ddf) On require() of the package, index.js unconditionally loads _runtime.js, which fetches an OS-specific binary from attacker-controlled hosts under oob-worker.cf1{00-03}-*.workers.dev (with a DNS TXT chunked-base64 fallback via *.dl.wel1.ru), writes it to /tmp or %TEMP% under a hidden/system-lookalike name, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. Destination hostnames are assembled at runtime from split string arrays (e.g. ["oob-worker.cf100-416.wor","ker","s.de","v"].join("") and ['sdk.dl.wel','1.ru'].join("")) to defeat static matching, and environment gates (DISABLE_TELEMETRY, DO_NOT_TRACK, globalThis.__ANALYTICS_SKIP) plus a /tmp/.analytics_state mtime dedup stamp cloak the behavior. The exported BoxyDevtools class is a no-op stub; the sole runtime effect on import is invoking the dropper. Package name and metadata are consistent with a typosquat/impersonation shell around the payload.

    References: https://www.npmjs.com/package/boxy-devtools/v/35.9.5

    Affected packages

    Package

    Name: boxy-devtools

    Purl: pkg:npm/boxy-devtools

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.5
    MAL-2026-13039 | CVE-DB