MAL-2026-13055
Dashboard / Malicious Package / MAL-2026-13055
MAL-2026-13055
Summary: Malicious code in boxy-loader (npm)
Details: Source: amazon-inspector (bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c) On require('boxy-loader'), index.js loads _adapter.js which executes setup() at module top level. setup() picks a platform-specific remote path, downloads an opaque executable from obfuscated Cloudflare Workers hosts (hostnames such as oob-worker.cf*.workers.dev are assembled at runtime by joining split string fragments), writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. If the HTTPS fetch fails, loadViaDns() falls back to resolveTxt('c.<domain>') to obtain a chunk count and then resolveTxt('<i>.<domain>') against *.dl.wel1.ru, base64-decodes the concatenated TXT records, writes the resulting bytes to disk and executes them — a DNS-tunneled payload channel designed to survive HTTPS egress filtering. Both the CDN host list and the DNS discovery domains are constructed from split string fragments to hide destinations from string-matching scans. The fetched executable is not shipped in the tarball, is not pinned or hash-verified, and is unrelated to any documented package purpose; the staging filename decoys (.cache_<hex>, dotnet_diag_<hex>.exe) further conceal it.
Affected packages
Package
Name: boxy-loader
Purl: pkg:npm/boxy-loader
Affected ranges
Type: N/A
Events:
