MAL-2026-13035

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-cook/MAL-2026-13035.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13035
Published
2026-08-05T14:32:58Z
Modified
2026-08-05T15:51:52.576262570Z
Summary
Malicious code in boxy-cook (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (838730a7f01e8f6ae8a0c6b51b78d64ed8fd488364b6004826b4051e75416388)

On require of the package, index.js loads polyfill.js which fetches a platform-specific native binary and executes it. Destination hostnames are assembled at runtime by joining split string fragments (e.g. sdk.dl.wel1.ru, oob-worker.cf102-baf.workers.dev) to evade static inspection. A secondary channel resolves DNS TXT records under *.dl.wel1.ru, concatenates base64 chunks, and Buffer.from-decodes them into an executable payload. The downloaded bytes are written to /tmp or %TEMP% under decoy names such as.cache<hex> and dotnetdiag<hex>.exe, chmod'd 0755, and launched detached via /bin/sh -c or cmd /c start. Execution is guarded by DISABLETELEMETRY / ANALYTICSOPTOUT / DONOT_TRACK environment variables and a filesystem stamp for deduplication. The package advertises itself as an abstraction layer; fetching and executing native binaries from obfuscated infrastructure is unrelated to that stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015345",
            "modified_time": "2026-08-05T14:32:58Z",
            "versions": [
                "35.5.4"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:46.038899051Z",
            "sha256": "838730a7f01e8f6ae8a0c6b51b78d64ed8fd488364b6004826b4051e75416388"
        }
    ]
}
References
Credits

Affected packages

npm / boxy-cook

Package

Name
boxy-cook
View open source insights on deps.dev
Purl
pkg:npm/boxy-cook

Affected ranges

Affected versions

35.*
35.5.4

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "2911be13f84736a5dceda04c43504242c7ffa761",
                "sha512_sri": "sha512-IBIja/pi4xHHfKE5++3bu7+19ogvISNnBd0fabWgPFBpHqiPhvoNFGqwFGuC99Du6I92baNkODe+zu85n+YzhA=="
            },
            "filename": "boxy-cook-35.5.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "5eee014d9af41a21e878d3fca2dbc3f9e6364055ddeff9ef05bafc97b744cfd8",
            "path": "_polyfill.js",
            "tlsh": "1fa1b7aa166670194b70dbe0c71b5415f55bf6633380d298fb9ca9981fb312483b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-cook/MAL-2026-13035.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]