MAL-2026-13058

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-maker-bus/MAL-2026-13058.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13058
Published
2026-08-05T14:29:13Z
Modified
2026-08-05T15:52:02.131763778Z
Summary
Malicious code in boxy-maker-bus (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b8e609c87c0dbbf2a870faf3c1e8ea2b322b32d147974f4ec62c400fd026744a)

boxy-maker-bus@35.7.7 acts as a load-time dropper. The package's index.js unconditionally requires compat.js on load, which assembles Cloudflare Workers hostnames (oob-worker.cf99-9b3/cf100-416/cf101-adf.workers.dev) and a wel1.ru-based DNS covert channel from split string fragments, downloads a platform-specific opaque binary over HTTPS with no hash or signature verification, writes it to a disguised path (dotnetdiag<token>.exe on Windows,.cache<token> on POSIX) under /tmp or %TEMP%, chmods 0755, and spawns it detached via cmd.exe /c start /b or /bin/sh -c. A secondary delivery path enumerates DNS TXT records at c.<domain> and <i>.<domain>, concatenates the chunks, and base64-decodes them into the executable payload. The dropper is wrapped in cover-story naming (analyticsstate stamp file, DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK env gates, an unused lib/telemetry.js labeled 'Analytics SDK', dotnet_diag filename) that does not correspond to the package's stated 'runtime support module' purpose. The delivered bytes are attacker-controlled and unverified, giving whoever controls the workers.dev and wel1.ru infrastructure arbitrary code execution on any host that installs or imports the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.7.7"
            ],
            "id": "IN-MAL-2026-015319",
            "import_time": "2026-08-05T15:19:44.637368917Z",
            "modified_time": "2026-08-05T14:29:13Z",
            "source": "amazon-inspector",
            "sha256": "b8e609c87c0dbbf2a870faf3c1e8ea2b322b32d147974f4ec62c400fd026744a"
        }
    ]
}
References
Credits

Affected packages

npm / boxy-maker-bus

Package

Name
boxy-maker-bus
View open source insights on deps.dev
Purl
pkg:npm/boxy-maker-bus

Affected ranges

Affected versions

35.*
35.7.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-cA5MuJKee3y5QRMdZMm1WBLBEMFHHP8KwJYlTj754mKLy576CULr1yOwXEwQFR5Z5Sp9iQgLAirfQhF2rSV2lQ==",
                "sha1": "1656af5b4499c4941fd7a75be187867b3d23abec"
            },
            "filename": "boxy-maker-bus-35.7.7.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_compat.js",
            "tlsh": "23b1c59a116670184f70ebe4c61b8815f96af6633781c284fb9c99984fb3514c372efc",
            "sha256": "7414bdd256ebf5ba6be881a3e876b58342b28d88287ecadbd34175154334d383"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-maker-bus/MAL-2026-13058.json"