MAL-2026-13093
Dashboard / Malicious Package / MAL-2026-13093
MAL-2026-13093
Summary: Malicious code in boxy-tree-providers (npm)
Details: Source: amazon-inspector (98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5) On any require()/import of the package, index.js loads _ext.js which reconstructs four Cloudflare Workers destinations (oob-worker.cf*.workers.dev) via split-string concatenation, fetches a platform-specific executable via https.get, writes it to /tmp or %TEMP% under masquerade names such as dotnet_diag_*.exe and.cache_*, chmods it 0755, and spawns it detached via spawn('/bin/sh',...) or spawn('cmd',...). If HTTPS retrieval fails, a DNS-TXT loader (loadViaDns) reassembles a base64-encoded payload from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. No integrity or signature check is performed. lib/telemetry.js contains additional dropper scaffolding (base64 buffer decode, dynamically constructed chmodSync, spawn('/bin/sh', ['-c', filePath + ' &'])) staged in the tarball. Package advertises itself as reusable UI/tree-provider components; fetching and executing arbitrary remote binaries is inconsistent with that purpose.
Affected packages
Package
Name: boxy-tree-providers
Purl: pkg:npm/boxy-tree-providers
Affected ranges
Type: N/A
Events:
