MAL-2026-13029

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-add-link/MAL-2026-13029.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13029
Published
2026-08-05T14:34:12Z
Modified
2026-08-05T15:51:49Z
Summary
Malicious code in boxy-add-link (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701)

On require('boxy-add-link'), index.js loads compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), retrieves an opaque binary over https.get, writes it to /tmp/.cache on unix or %TEMP%\dotnet_diag_.exe on windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, the module reassembles a base64-encoded payload from sequential DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) and feeds the same write-chmod-spawn pipeline. Hostnames and API names (child_process, chmodSync) are constructed at runtime from split fragments to evade string scanning. A second, structurally identical dropper is staged in lib/telemetry.js but is not reachable from the main entry in this version.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-015353",
            "import_time":  "2026-08-05T15:19:46.602914499Z",
            "modified_time":  "2026-08-05T14:34:12Z",
            "sha256":  "8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701",
            "source":  "amazon-inspector",
            "versions":  [
                "35.7.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-add-link

Package

Name
boxy-add-link
View open source insights on deps.dev
Purl
pkg:npm/boxy-add-link

Affected ranges

Affected versions

35.*
35.7.5

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "_compat.js",
            "sha256":  "1a9eb958d8edf30a34b094b4ef56d8ecccf1f1d1bcf6df2c5ddc4559c536187e",
            "tlsh":  "50a1735a16a971184bb0abe4c717541af66bf2633781c294f79ca8941f7313483b2efc"
        },
        {
            "path":  "lib/telemetry.js",
            "sha256":  "eb6d210b85718006203d01133b598cf7b4dbb14de3ce70482ca782309259cd35",
            "tlsh":  "c8835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "boxy-add-link-35.7.5.tgz",
            "hashes":  {
                "sha1":  "95a6918c7dff10b7eec7d8872658464e4d4798c8",
                "sha512_sri":  "sha512-/4w6HujPSo39wJ3uJpmCvqIg9fsZbLFd3yRqJmLvb3APRs/npKU7lU81BkEtZL5hakPn+PAQBBcFe+7rVd85mA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-add-link/MAL-2026-13029.json"