MAL-2026-13089

Dashboard / Malicious Package / MAL-2026-13089

MAL-2026-13089

Summary: Malicious code in boxy-test-block-fixture (npm)

Details: Source: amazon-inspector (b10e5c9aa6fedcb9d29f292cd6f5aa6634e770f46c6385a9fb32c0fc628ab27a) On require()/import of the package, _init.js assembles attacker-controlled hostnames at runtime by joining split string fragments (resolving to oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), fetches a platform-specific binary over HTTPS, and if that fails, falls back to a DNS-TXT covert channel that reassembles base64-encoded payload chunks from subdomains of dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under cover-story names such as 'dotnet_diag_*.exe' and '.cache_*', chmod 0755, and executed detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or the cmd equivalent on Windows). No signature or hash verification is performed. The destination hostnames are obfuscated via array-join splitting to evade static string scans, and the DNS-TXT fallback bypasses HTTPS egress filtering. Any project that installs and loads this package executes attacker-controlled native code on the host.

References: https://www.npmjs.com/package/boxy-test-block-fixture/v/35.5.5