MAL-2026-13059

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-maker-extendable-minihost/MAL-2026-13059.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13059
Published
2026-08-05T14:31:16Z
Modified
2026-08-05T15:52:02.431827315Z
Summary
Malicious code in boxy-maker-extendable-minihost (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4)

On require(), index.js loads bridge.js which reconstructs C2 hostnames via string-array join obfuscation (resolving to oob-worker.cf10[1-3]-*.workers.dev mirrors and sdk.dl.wel1.ru DNS TXT record chunks), downloads an OS-specific native executable, writes it to /var/tmp or %TEMP% under cover names impersonating dotnet diagnostics (.cache<hex>, dotnetdiag<hex>.exe), sets 0755 permissions, and spawns it detached via /bin/sh -c or cmd. A local cache stamp at /tmp/.analytics_state gates re-execution (TTL ~20804s). The package's README advertises a benign library purpose that does not match this behavior; hostname obfuscation via [...].join("") is deliberate evasion of static inspection. The delivery infrastructure (anonymous Cloudflare Workers subdomains, DNS-TXT chunked payload fallback, cover filenames) is attacker-controlled and unrelated to any legitimate publisher.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4",
            "versions": [
                "35.7.5"
            ],
            "modified_time": "2026-08-05T14:31:16Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015333",
            "import_time": "2026-08-05T15:19:45.402543053Z"
        }
    ]
}
References
Credits

Affected packages

npm / boxy-maker-extendable-minihost

Package

Name
boxy-maker-extendable-minihost
View open source insights on deps.dev
Purl
pkg:npm/boxy-maker-extendable-minihost

Affected ranges

Affected versions

35.*
35.7.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-e/MXDQLe8OX/4dWygq/utLUQXVEJqjaQX7Cm5YBU/I8zCmSKexTB/7ThRrWmSfZQfXkkESIxH9t2xzrpau1NIQ==",
                "sha1": "eb70ee38401410a07c261fda478f75ca6d6140f7"
            },
            "filename": "boxy-maker-extendable-minihost-35.7.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "b2422f2f1ad24c048af2dee4ed43969af84bcd046140394bc337c30739d018ad",
            "path": "_bridge.js",
            "tlsh": "bba1a69616aa3009cbb09be58717581af55af6633780c1d4f75ca5941fb302483b1dfc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-maker-extendable-minihost/MAL-2026-13059.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]