MAL-2026-13043

    Dashboard / Malicious Package / MAL-2026-13043

    MAL-2026-13043

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-expander-contract (npm)

    Details: Source: amazon-inspector (d1f5856de3b0385535e80e5ef85627ecb7a087132c82c5d5457b35b62b9eaf72) On require() of this package, index.js loads./_runtime.js which assembles Cloudflare Workers hostnames via string-split.join('') fragments (e.g. oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT fallback under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under a name masquerading as system tooling (dotnet_diag_*.exe,.cache_*), chmods 755 on unix, and spawns it detached via spawn('/bin/sh', ['-c',...]) or spawn('cmd',...). No hash or signature verification is performed and destination hosts are string-fragmented to evade static analysis. The package's advertised API is an unrelated decoy stub.

    References: https://www.npmjs.com/package/boxy-expander-contract/v/35.5.3

    Affected packages

    Package

    Name: boxy-expander-contract

    Purl: pkg:npm/boxy-expander-contract

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.5.3
    MAL-2026-13043 | CVE-DB