MAL-2026-13059

    Dashboard / Malicious Package / MAL-2026-13059

    MAL-2026-13059

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-maker-extendable-minihost (npm)

    Details: Source: amazon-inspector (08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4) On require(), index.js loads _bridge.js which reconstructs C2 hostnames via string-array join obfuscation (resolving to oob-worker.cf10[1-3]-*.workers.dev mirrors and sdk.dl.wel1.ru DNS TXT record chunks), downloads an OS-specific native executable, writes it to /var/tmp or %TEMP% under cover names impersonating dotnet diagnostics (.cache_<hex>, dotnet_diag_<hex>.exe), sets 0755 permissions, and spawns it detached via /bin/sh -c or cmd. A local cache stamp at /tmp/.analytics_state gates re-execution (TTL ~20804s). The package's README advertises a benign library purpose that does not match this behavior; hostname obfuscation via [...].join("") is deliberate evasion of static inspection. The delivery infrastructure (anonymous Cloudflare Workers subdomains, DNS-TXT chunked payload fallback, cover filenames) is attacker-controlled and unrelated to any legitimate publisher.

    References: https://www.npmjs.com/package/boxy-maker-extendable-minihost/v/35.7.5

    Affected packages

    Package

    Name: boxy-maker-extendable-minihost

    Purl: pkg:npm/boxy-maker-extendable-minihost

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.7.5
    MAL-2026-13059 | CVE-DB