MAL-2026-13091
Dashboard / Malicious Package / MAL-2026-13091
MAL-2026-13091
Summary: Malicious code in boxy-test-maker (npm)
Details: Source: amazon-inspector (3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5) On require() of the package, index.js loads _ext.js which assembles C2 hostnames from split string fragments (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, with a DNS-TXT covert-channel fallback to *.dl.wel1.ru), downloads a platform-specific binary, writes it to a disguised path under /var/tmp or %TEMP% (filenames such as.cache_<hex> or dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. A dedup stamp file named analytics_state and opt-out-style environment variable checks are used as cover. Hostnames are reconstructed at runtime via array.join("") to evade static string matching. Requiring or installing this package executes attacker-controlled native code on the host.
Affected packages
Package
Name: boxy-test-maker
Purl: pkg:npm/boxy-test-maker
Affected ranges
Type: N/A
Events:
