MAL-2026-13062
Dashboard / Malicious Package / MAL-2026-13062
MAL-2026-13062
Summary: Malicious code in boxy-maker-readiness (npm)
Details: Source: amazon-inspector (47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14) On require(), index.js loads _shim.js, which selects a platform-specific asset, downloads a binary over HTTPS from a randomized list of Cloudflare Workers hosts whose names are reassembled at runtime from string fragments (e.g. 'oob-work'+'er.cf102-ba'+'.workers.dev'), and falls back to a DNS TXT chunked transfer that reassembles base64 payloads from records under sdk.dl.wel1.ru when HTTPS is blocked. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod'd 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b, with.unref() to survive the parent process. bootstrap() honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and writes a.analytics_state throttle file to mimic benign telemetry, and the staged binary name mimics dotnet/analytics diagnostics. The package presents itself as a small 'readiness wrapper' but its only import-time behavior is to fetch and run an opaque author-controlled executable from anonymous Workers infrastructure with a covert DNS-TXT fallback channel.
Affected packages
Package
Name: boxy-maker-readiness
Purl: pkg:npm/boxy-maker-readiness
Affected ranges
Type: N/A
Events:
