MAL-2026-13046

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-fixture-pendel/MAL-2026-13046.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13046
Published
2026-08-05T14:31:44Z
Modified
2026-08-05T15:51:57.150527339Z
Summary
Malicious code in boxy-fixture-pendel (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830)

On require('boxy-fixture-pendel'), index.js loads support.js which asynchronously downloads a platform-specific binary from obfuscated destinations assembled at runtime via string-array.join('') — oob-worker.cf103-070.workers.dev and related Cloudflare Workers subdomains, with a DNS-TXT-record fallback channel that reassembles a base64-encoded binary from numbered TXT records under net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under cover-story filenames (dotnetdiag_*.exe,.cache_*), chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached: true}) or the Windows equivalent. There is no hash or signature verification, and the download destinations are unrelated to the package publisher. A second copy of the same dropper (split-concat hosts, /bin/sh -c spawn, chmod 0755, base64 buffer reassembly) is bundled in lib/telemetry.js under 'Analytics SDK' scaffolding; it is present in the tarball but not reached from index.js in this version. TTL caching and env-var opt-outs are included to reduce repeat triggering and aid evasion.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.9"
            ],
            "source": "amazon-inspector",
            "sha256": "dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830",
            "import_time": "2026-08-05T15:19:45.541339587Z",
            "modified_time": "2026-08-05T14:31:44Z",
            "id": "IN-MAL-2026-015336"
        }
    ]
}
References
Credits

Affected packages

npm / boxy-fixture-pendel

Package

Name
boxy-fixture-pendel
View open source insights on deps.dev
Purl
pkg:npm/boxy-fixture-pendel

Affected ranges

Affected versions

35.*
35.8.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-fixture-pendel/MAL-2026-13046.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "boxy-fixture-pendel-35.8.9.tgz",
            "hashes": {
                "sha1": "af458e679e57d99d988ee1810a61155252afef8e",
                "sha512_sri": "sha512-lBinQX49FRckw3KoBjvLGbnI6dXW/aWiPuhRq7fXBsfn7pi5tZZMfHbamDb6Tn5w/6KEkdOkAGYW9UDoPzzrqQ=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "0aa1a89a16aa70084bb097e087175416f65ff66337c0c2d4fb5ca5981f7612483b2efc",
            "sha256": "23482aa780951b434609eccb8d05cd2659f0395e58face84df121de9c2ee99c3",
            "path": "_support.js"
        },
        {
            "tlsh": "d7835f55566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "f544c43d88404e051c17e60ccd0d7ce6f3dbd1b019b9a4d8e1e9b5fd3669bf99",
            "path": "lib/telemetry.js"
        }
    ]
}