MAL-2026-13084

    Dashboard / Malicious Package / MAL-2026-13084

    MAL-2026-13084

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-sticky-providers (npm)

    Details: Source: amazon-inspector (cc08631cb79f90d5440020f420e9c7ad9e67ec84f25f085825c5b5f600f613a4) On require() of the package, _init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from split-string arrays (oob-worker.cf101-adf.workers.dev), with a DNS-TXT covert-channel fallback via sdk.dl.wel1.ru. The payload is staged to /var/tmp/.cache_<hex> on Unix or a dotnet_diag_<hex>.exe path on Windows, chmod 0755'd, and spawned detached through /bin/sh -c or cmd /c start. There is no hash or signature verification, the destinations are unrelated to any declared publisher, and the code uses disguised filenames, cooldown markers, and DISABLE_TELEMETRY/DO_NOT_TRACK kill-switches. Anyone who installs and require()s this package executes attacker-controlled bytes on their machine.

    References: https://www.npmjs.com/package/boxy-sticky-providers/v/35.1.5

    Affected packages

    Package

    Name: boxy-sticky-providers

    Purl: pkg:npm/boxy-sticky-providers

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.1.5
    MAL-2026-13084 | CVE-DB