MAL-2026-13131

    Dashboard / Malicious Package / MAL-2026-13131

    MAL-2026-13131

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in dolyame-boxy-stories (npm)

    Details: Source: amazon-inspector (c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4) On require, index.js loads _bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts whose names are reconstructed at runtime via string.join() to evade static detection (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT-record fallback under sdk.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start. A marker file.analytics_state and opt-out env vars DISABLE_TELEMETRY / ANALYTICS_OPT_OUT provide cover-story naming; the package's declared purpose is unrelated to any telemetry or analytics function, and the default code path executes the remote binary. This is a load-time full-host RCE dropper.

    Affected packages

    Package

    Name: dolyame-boxy-stories

    Purl: pkg:npm/dolyame-boxy-stories

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.7
    MAL-2026-13131 | CVE-DB