MAL-2026-13029

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-add-link/MAL-2026-13029.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13029
Published
2026-08-05T14:34:12Z
Modified
2026-08-05T15:51:49.650522562Z
Summary
Malicious code in boxy-add-link (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701)

On require('boxy-add-link'), index.js loads compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), retrieves an opaque binary over https.get, writes it to /tmp/.cache<hex> on unix or %TEMP%\dotnetdiag<hex>.exe on windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, the module reassembles a base64-encoded payload from sequential DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) and feeds the same write-chmod-spawn pipeline. Hostnames and API names (child_process, chmodSync) are constructed at runtime from split fragments to evade string scanning. A second, structurally identical dropper is staged in lib/telemetry.js but is not reachable from the main entry in this version.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701",
            "id": "IN-MAL-2026-015353",
            "modified_time": "2026-08-05T14:34:12Z",
            "import_time": "2026-08-05T15:19:46.602914499Z",
            "source": "amazon-inspector",
            "versions": [
                "35.7.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-add-link

Package

Name
boxy-add-link
View open source insights on deps.dev
Purl
pkg:npm/boxy-add-link

Affected ranges

Affected versions

35.*
35.7.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "1a9eb958d8edf30a34b094b4ef56d8ecccf1f1d1bcf6df2c5ddc4559c536187e",
            "path": "_compat.js",
            "tlsh": "50a1735a16a971184bb0abe4c717541af66bf2633781c294f79ca8941f7313483b2efc"
        },
        {
            "sha256": "eb6d210b85718006203d01133b598cf7b4dbb14de3ce70482ca782309259cd35",
            "path": "lib/telemetry.js",
            "tlsh": "c8835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-/4w6HujPSo39wJ3uJpmCvqIg9fsZbLFd3yRqJmLvb3APRs/npKU7lU81BkEtZL5hakPn+PAQBBcFe+7rVd85mA==",
                "sha1": "95a6918c7dff10b7eec7d8872658464e4d4798c8"
            },
            "filename": "boxy-add-link-35.7.5.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-add-link/MAL-2026-13029.json"