MAL-2026-13048

    Dashboard / Malicious Package / MAL-2026-13048

    MAL-2026-13048

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-fixture-sb (npm)

    Details: Source: amazon-inspector (569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07) On require() of boxy-fixture-sb, index.js loads _compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays (joined at runtime to form oob-worker.cf*.workers.dev), downloads a platform-specific binary via https.get, writes it to /tmp or %TEMP% under cover-story names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe /c start. A DNS-TXT fallback channel reads base64 payload chunks from c.<domain>/<i>.<domain> under *.dl.wel1.ru. Cover-story identifiers (analytics_state, DISABLE_TELEMETRY) and hostname obfuscation confirm evasion intent. The package name suggests a test fixture but its only observed effect at import is fetching and executing an opaque remote payload on the installer's machine.

    References: https://www.npmjs.com/package/boxy-fixture-sb/v/35.9.6

    Affected packages

    Package

    Name: boxy-fixture-sb

    Purl: pkg:npm/boxy-fixture-sb

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.6
    MAL-2026-13048 | CVE-DB