MAL-2026-13299
Dashboard / Malicious Package / MAL-2026-13299
MAL-2026-13299
Summary: Malicious code in dolyame-boxy-component-story-name (npm)
Details: Source: amazon-inspector (8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32) On require() of this package, _support.js reconstructs Cloudflare Workers hostnames from split string fragments (e.g. 'oob-work'+'er.cf101-ad'+...+'workers.'+'dev'), fetches a platform-specific executable, with a DNS-TXT chunked fallback via '*.dl.wel1.ru' (also reconstructed from fragments like ['sdk','.dl.wel1','.r','u'].join('')), writes it to a hidden randomized filename under /tmp (or %TEMP%), sets mode 0755, and spawns it detached and orphaned via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution is gated by a TTL stamp file to run at most once per ~23000 seconds. A parallel dropper implementation ships in lib/telemetry.js with additional obfuscation (require('child_'+'process'), fs['chmod'+'Sync'], base64-assembled payload chunks) framed as an APM telemetry SDK. The package's stated purpose is a reusable component library, so the fetch-and-execute pipeline is entirely covert. The delivered bytes are attacker-controlled and opaque, yielding arbitrary code execution on the installer's host on import.
Affected packages
Package
Name: dolyame-boxy-component-story-name
Purl: pkg:npm/dolyame-boxy-component-story-name
Affected ranges
Type: N/A
Events:
