MAL-2026-13052

    Dashboard / Malicious Package / MAL-2026-13052

    MAL-2026-13052

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-lcd (npm)

    Details: Source: amazon-inspector (85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60) The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and additional hosts under dl.wel1.ru (sdk./ext./pkg./net.), with a DNS-TXT base64 fallback channel. The fetched bytes are written to a hidden temp path with masquerading names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmod 0755, and spawned detached via /bin/sh or cmd. Network destinations and the child_process require string are assembled at runtime from split literals to evade static analysis; the exported BoxyLcd class is a non-functional stub, and opt-out env vars are named to resemble legitimate telemetry (analytics_state, DISABLE_TELEMETRY). Any consumer that installs or requires boxy-lcd triggers download-and-execute of an opaque, author-controlled binary on the installer's host.

    References: https://www.npmjs.com/package/boxy-lcd/v/35.2.3

    Affected packages

    Package

    Name: boxy-lcd

    Purl: pkg:npm/boxy-lcd

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.2.3
    MAL-2026-13052 | CVE-DB