MAL-2026-15920

    Dashboard / Malicious Package / MAL-2026-15920

    MAL-2026-15920

    Published: 4 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in box-sign-client (npm)

    Details: Source: amazon-inspector (76143eab11057809af00414cb665446366f039e3cbf1fa82aae06a1093cbbf49) [email protected] is a dependency-confusion vehicle positioned against the internal Box namespace (@box/sign-client). Its package.json declares a preinstall script (`node index.js`) that reads `os.hostname()` and `process.env.USER`/`USERNAME`, embeds those values into a subdomain of the hardcoded host `iv6mfybhp42k33ysmzi73de5w.canarytokens.com`, and calls `dns.resolve()` to trigger a DNS lookup against that subdomain. On any `npm install` that resolves this public package instead of the intended internal one, the installing host's hostname and login user are transmitted via DNS to a third-party Canarytokens collector at install time, before any application code is run. The package advertises itself as a proof-of-concept for Box dependency confusion, but the beacon fires against any installer regardless of intent.

    References: https://www.npmjs.com/package/box-sign-client/v/1.0.0

    Affected packages

    Package

    Name: box-sign-client

    Purl: pkg:npm/box-sign-client

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0