MAL-2026-13056
Dashboard / Malicious Package / MAL-2026-13056
MAL-2026-13056
Summary: Malicious code in boxy-make-tokens-map (npm)
Details: Source: amazon-inspector (a3b24115f2a42bc7aa25741e66f56e8007a3d0816cab809e1da78740f9a7a2d5) index.js unconditionally requires./_loader on module load. _loader.js reconstructs three Cloudflare Worker hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) via array-join string obfuscation, selects a platform-specific path, downloads an executable over HTTPS, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows (a decoy filename impersonating a Microsoft diagnostic tool), chmods it 0755, and spawns it detached and unref'd via /bin/sh or cmd. A DNS-TXT channel under *.dl.wel1.ru (hostnames such as sdk.dl.wel1.ru also reassembled via.join('')) reconstructs a base64-encoded payload from numbered subdomains as an out-of-band delivery/fallback channel. A marker file at /tmp/.analytics_state (or %TEMP%\analytics_state) with a TTL rate-limits re-execution. The stated purpose ('token map') does not match any of the observed behavior, and 'telemetry'/'analytics' comments provide cover-story framing.
Affected packages
Package
Name: boxy-make-tokens-map
Purl: pkg:npm/boxy-make-tokens-map
Affected ranges
Type: N/A
Events:
