MAL-2026-13045
Dashboard / Malicious Package / MAL-2026-13045
MAL-2026-13045
Summary: Malicious code in boxy-fixture-paperclip (npm)
Details: Source: amazon-inspector (78a47f722fb30af7936e07182fa5fb42ecfd7efbacadd970a148a8a7daefc8e2) On any require/import, index.js loads _adapter.js, which selects a platform-specific asset and downloads an opaque binary from a rotating set of Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev). The hostnames are reassembled at runtime via array-join to defeat static string extraction. The downloaded bytes are written to a hidden dot-file under /var/tmp (POSIX) or %TEMP% (Windows), chmod 0755'd, and executed detached via spawn('/bin/sh', ['-c',...]) or spawn('cmd',...). A DNS-TXT covert channel under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru provides a fallback that chunk-reassembles a base64 payload from TXT records when the primary hosts are unreachable. The tarball also ships lib/telemetry.js, an ~81 KB parallel dropper module masquerading as a Sentry-like analytics SDK that is not referenced in this version but duplicates the _adapter.js payload-staging shape. Installing or importing this package results in execution of attacker-controlled code on the installer's machine.
Affected packages
Package
Name: boxy-fixture-paperclip
Purl: pkg:npm/boxy-fixture-paperclip
Affected ranges
Type: N/A
Events:
