MAL-2026-13031

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-bus-providers/MAL-2026-13031.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13031
Published
2026-08-05T14:34:40Z
Modified
2026-08-05T15:51:50.854764802Z
Summary
Malicious code in boxy-bus-providers (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79)

On require() of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-.workers.dev through cf103-.workers.dev) with a DNS-TXT base64 fallback from *.dl.wel1.ru, writes the payload to /tmp or %TEMP% under disguised names (.cache<hex>, dotnetdiag<hex>.exe), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). C2 hostnames and dangerous API names are string-split and reassembled at runtime (e.g., ['oob-worker.cf102-baf.wor','kers.dev'].join(''), require('child_'+'process'), fs['chmod'+'Sync']) to evade static detection. A sibling module lib/telemetry.js contains an identical fetch-decode-chmod-exec chain with a base64-reassembled payload delivered over DNS, staged as a secondary/updater dropper. The declared package purpose does not require downloading and executing an unpinned remote binary from anonymous workers.dev infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79",
            "id": "IN-MAL-2026-015356",
            "modified_time": "2026-08-05T14:34:40Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:46.819802096Z",
            "versions": [
                "35.3.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-bus-providers

Package

Name
boxy-bus-providers
View open source insights on deps.dev
Purl
pkg:npm/boxy-bus-providers

Affected ranges

Affected versions

35.*
35.3.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "d6538b0b356c888d991270a1822c242712b55e6eea7d04b55b2f4e89084e3e3d",
            "path": "_compat.js",
            "tlsh": "cfa1985a156a70198bb0ebf48717441af65bfa633780c284fb5c69985f7212483b3dfc"
        },
        {
            "sha256": "c9977e089313cec9a769971466486e55793e60a250782ce998032fabf14826ff",
            "path": "lib/telemetry.js",
            "tlsh": "eb835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-TWWs+08cisNpNWjjBAE93BtGZg9iIfIRkbV+CqTqfMUKD2as2MN6cjLnIXLyL+u5fvHtKoxK8xFyKJzX1yHtgQ==",
                "sha1": "89f963cea7ae7e85c93ea8edb157a8b7db73704e"
            },
            "filename": "boxy-bus-providers-35.3.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-bus-providers/MAL-2026-13031.json"