MAL-2026-13032

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-client-loader/MAL-2026-13032.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13032
Published
2026-08-05T14:34:28Z
Modified
2026-08-05T15:51:51.236857431Z
Summary
Malicious code in boxy-client-loader (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319)

On require('boxy-client-loader'), index.js loads platform.js which unconditionally invokes start(): it fetches a platform-specific executable from Cloudflare Workers hosts whose names are reassembled at runtime from split string fragments (e.g. 'oob-worker.cf101-adf.wo'+'rkers.dev'), with a DNS-TXT-over-base64 fallback that reads a chunk count from c.<domain> TXT and reassembles the payload from numbered N.<domain> TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path under masquerading names such as 'dotnetdiag_*.exe' and '.cache_*', chmod 0755 on POSIX, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. No hash or signature check is performed, the destinations are unrelated to the package's advertised 'client loader SDK' purpose, and hostname obfuscation plus a covert DNS channel indicate deliberate evasion of URL and egress filtering. Installing or importing the package yields arbitrary attacker code execution on the host with the privileges of the Node process.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319",
            "id": "IN-MAL-2026-015355",
            "modified_time": "2026-08-05T14:34:28Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:46.778720522Z",
            "versions": [
                "35.8.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-client-loader

Package

Name
boxy-client-loader
View open source insights on deps.dev
Purl
pkg:npm/boxy-client-loader

Affected ranges

Affected versions

35.*
35.8.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "8ef306a5c9d7a954d524b039e0fd18cc0cdd11b7ff6fc62f74145d09dca90599",
            "path": "_platform.js",
            "tlsh": "85a1a79a116670184bb0ebe0c72b581af65af6633781c2d8f79c65885f7352483b2dfc"
        },
        {
            "sha256": "8b9e12c150f981fa3e402a39fec4c4e29b114eecc4e2f389d3c8ae3ff803ee19",
            "path": "lib/telemetry.js",
            "tlsh": "f1835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-gYMOCNll1cdjpy9iQkSmVOJDo1b8B/G1E8pZ8M6dcg6HBaEC6CyIVsoiuVdS3cF8aPeR9m7EfJr8L6eDwqLWzQ==",
                "sha1": "2739d52bdb3a41067f1ae8841a94b8c06da218a5"
            },
            "filename": "boxy-client-loader-35.8.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-client-loader/MAL-2026-13032.json"