MAL-2026-13036

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-debugger/MAL-2026-13036.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13036
Published
2026-08-05T14:32:15Z
Modified
2026-08-05T15:51:53.050028917Z
Summary
Malicious code in boxy-debugger (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2)

boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled destinations from split string arrays (hosts under oob-worker.cf*.workers.dev and *.dl.wel1.ru), downloads a platform-specific native binary via https.get, writes it to /tmp or %TEMP% under cover-story names such as.cache<hex> and dotnetdiag<hex>.exe, chmods it to 0755, and spawns it detached through /bin/sh -c or cmd.exe /c start. A DNS-TXT chunked-base64 channel over *.dl.wel1.ru serves as a fallback delivery path, and a sibling module lib/telemetry.js carries parallel dropper logic (base64 payload assembly, spawn of /bin/sh -c, chmod 0755 via string-concatenated "chmod"+"Sync") staged as latent payload. Destinations are unpinned, unsigned, and obfuscated; the framing as telemetry/analytics does not match the actual behavior, which is full-host remote code execution against every environment that installs or imports the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:32:15Z",
            "id": "IN-MAL-2026-015340",
            "import_time": "2026-08-05T15:19:45.738278346Z",
            "versions": [
                "35.3.4"
            ],
            "source": "amazon-inspector",
            "sha256": "0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2"
        }
    ]
}
References
Credits

Affected packages

npm / boxy-debugger

Package

Name
boxy-debugger
View open source insights on deps.dev
Purl
pkg:npm/boxy-debugger

Affected ranges

Affected versions

35.*
35.3.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-debugger/MAL-2026-13036.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "boxy-debugger-35.3.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-ldPF0VyFL3PJbyizexL3+khw3GSibpEmIv5gDldINqbMLlatAkKVSaxcGVDHVcmxI5Px80NudcSJXtHmf9LXQw==",
                "sha1": "9277c70ec806344430a17f9fad5ca15be6a9d190"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_platform.js",
            "tlsh": "6eb1a69a016a71198bb0dbe487274426f66bf6633281c2c4f76c99845f73524c372dfc",
            "sha256": "8f1a86fb82c5e650a822400a8c67232517ddd9a0b1a5712095a8cfead0623dfb"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "05835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "4e830df92cc475368422d814729093a25c6456a6aa903eefa80ef4f56b1a76f9"
        }
    ]
}