MAL-2026-13068
Dashboard / Malicious Package / MAL-2026-13068
MAL-2026-13068
Summary: Malicious code in boxy-mif-tokens (npm)
Details: Source: amazon-inspector (e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7) On require() of this package, index.js loads _bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare Workers hostnames (reassembled at runtime via ["...","..."].join("")) with a DNS TXT-record base64 fallback channel over *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under decoy names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmod 0755, and spawned detached via /bin/sh -c '<path> &' on Unix or cmd /c start /b on Windows, using child_process.spawn(...).unref(). The package presents itself as a token SDK and has no legitimate need to fetch and execute an unpinned, unhashed native binary from non-publisher infrastructure. Hostname reassembly, DNS-over-TXT delivery fallback, hidden staging paths, and decoy filenames are evasion characteristics of a dropper, not of a normal SDK download.
Affected packages
Package
Name: boxy-mif-tokens
Purl: pkg:npm/boxy-mif-tokens
Affected ranges
Type: N/A
Events:
