MAL-2026-13034

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-contract/MAL-2026-13034.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13034
Published
2026-08-05T14:34:21Z
Modified
2026-08-05T15:51:52.336865205Z
Summary
Malicious code in boxy-contract (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (01882c522b96942398bba4079e225224c0672793444cb1a8ce700d3441848ee5)

On require() of boxy-contract, index.js loads init.js which selects a platform-specific endpoint and downloads a binary over HTTPS from string-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev), with a DNS-TXT fallback under *.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under disguised names such as dotnetdiag<hex>.exe and.cache<hex>, chmod'd to 0755, and spawned detached via spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd.exe /c start /b. Destination hostnames and dangerous API names (childprocess, chmodSync) are assembled from fragmented literals joined at runtime to evade static analysis. A DISABLETELEMETRY environment gate and cover-story naming (.analyticsstate marker, dotnetdiag_ filenames) present the behavior as diagnostics but do not represent user-consented telemetry. The dropped binary is an opaque, unpinned, unverified native executable from attacker-controlled infrastructure, granting arbitrary code execution on the installer's host on plain npm install / require.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "01882c522b96942398bba4079e225224c0672793444cb1a8ce700d3441848ee5",
            "id": "IN-MAL-2026-015354",
            "modified_time": "2026-08-05T14:34:21Z",
            "import_time": "2026-08-05T15:19:46.68808667Z",
            "source": "amazon-inspector",
            "versions": [
                "35.4.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-contract

Package

Name
boxy-contract
View open source insights on deps.dev
Purl
pkg:npm/boxy-contract

Affected ranges

Affected versions

35.*
35.4.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "cf3c6a1d2162038e49716adaf45538e8dad2d43582e1aac71922b80bf01c046b",
            "path": "_init.js",
            "tlsh": "2fa1866a06a6701c4bb0dbe8ca176415f55bf663738086d4fb9c65d81ff211482b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-XtS5oSHS+B+6dIctJ5x6sSdY0JdA48ZR/E3/sOOCknLEb4GY92sc/aE3cBfQ370+KShI4EdL6RDMUiPbEkcpOQ==",
                "sha1": "63ee0b5a660921f2136fa27ceaebb45a1cca2dcc"
            },
            "filename": "boxy-contract-35.4.3.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-contract/MAL-2026-13034.json"