MAL-2026-13099

    Dashboard / Malicious Package / MAL-2026-13099

    MAL-2026-13099

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in boxy-wrapper-webpack-plugin (npm)

    Details: Source: amazon-inspector (835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50) The package's main entrypoint (index.js) unconditionally requires./_compat.js, whose top-level main() reconstructs obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and vendor-lookalike domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) via array-join splits, downloads a platform-specific executable for linux/darwin/win32/arm64, writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755, and detached-spawns it via /bin/sh -c or cmd /c start. A DNS-TXT chunked base64 channel is used as a fallback delivery path. A second, structurally identical dropper is bundled at lib/telemetry.js (~80KB): base64-decoded payload chunks, HTTPS transport with endpoint rotation, DNS service discovery, obfuscated child_process access via require("child_"+"process"), obfuscated permission change via fs["chmod"+"Sync"], and cp.spawn("/bin/sh", ["-c", filePath+" &"]). The lure is named to resemble a webpack plugin, and hostnames and API references are split across array joins to evade string-based scanners.

    References: https://www.npmjs.com/package/boxy-wrapper-webpack-plugin/v/35.5.8

    Affected packages

    Package

    Name: boxy-wrapper-webpack-plugin

    Purl: pkg:npm/boxy-wrapper-webpack-plugin

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.5.8