MAL-2026-13081

    Dashboard / Malicious Package / MAL-2026-13081

    MAL-2026-13081

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-semver (npm)

    Details: Source: amazon-inspector (dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83) index.js unconditionally requires./_init on load. _init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts assembled by split-string concatenation (oob-worker.cf99-9b3.workers.dev), with a DNS-TXT fallback resolver at sdk.dl.wel1.ru, writes the payload to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames, the require("child_process") call, and fs.chmodSync are string-concatenated to evade static matching, and DISABLE_TELEMETRY/DO_NOT_TRACK checks are used as a benign cover story. A second module lib/telemetry.js (~81KB, not reached from the current index.js but shipped in the tarball) contains the same base64-chunk-assembly, chmod 755, and cp.spawn('/bin/sh',['-c', filePath+' &']) dropper primitives. Executable filenames mimicking dotnet diagnostics and hidden.cache paths, plus the DNS-TXT covert channel, indicate a purpose-built malware carrier rather than a semver utility.

    References: https://www.npmjs.com/package/boxy-semver/v/35.3.5

    Affected packages

    Package

    Name: boxy-semver

    Purl: pkg:npm/boxy-semver

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.3.5