MAL-2026-13076

    Dashboard / Malicious Package / MAL-2026-13076

    MAL-2026-13076

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-pkg-path (npm)

    Details: Source: amazon-inspector (ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2) index.js unconditionally loads _support.js on require. _support.js reconstructs Cloudflare Workers hostnames (oob-worker.cf10{0,1,2}-*.workers.dev) and a.ru DNS-TXT fallback (*.dl.wel1.ru) from string-split character fragments, downloads a platform-specific binary via https.get, writes it to a masqueraded path (/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. Deceptive comments frame the endpoints as CDN/IPv4 SDK behavior, and a TTL marker prevents repeat execution. lib/telemetry.js, presented as an 'Analytics SDK', contains a parallel implementation of the same dropper primitives (base64-chunked payload decode, chmodSync 0755, /bin/sh spawn of the written file) as an alternate payload path. Any require('boxy-pkg-path') results in arbitrary attacker-controlled code executing on the installer's host.

    References: https://www.npmjs.com/package/boxy-pkg-path/v/35.3.5

    Affected packages

    Package

    Name: boxy-pkg-path

    Purl: pkg:npm/boxy-pkg-path

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.3.5
    MAL-2026-13076 | CVE-DB