MAL-2026-13069

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-mm-advisor/MAL-2026-13069.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13069
Published
2026-08-05T14:27:47Z
Modified
2026-08-05T15:52:08.134085309Z
Summary
Malicious code in boxy-mm-advisor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a)

On require of boxy-mm-advisor, index.js loads init.js which auto-runs init(). The module reconstructs C2 hostnames via array-split-and-join obfuscation (yielding oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, and sdk/ext/pkg/net.dl.wel1.ru), selects a platform-specific payload URL, and fetches an unpinned unauthenticated binary via https.get. On POSIX it writes the bytes to /tmp/.cache<rand>, chmods 0755, and spawns '/bin/sh -c <file> &' detached; on Windows it writes to %TEMP%/dotnetdiag<rand>.exe (impersonating a Microsoft diagnostic binary) and spawns via cmd.exe /c start /b detached. If HTTPS retrieval fails, dns.resolveTxt is used to read a chunk count from c.<domain>.dl.wel1.ru and to pull base64 chunks from 0.<domain>, 1.<domain>,..., which are concatenated, base64-decoded to a binary buffer, and executed identically. A.analytics_state marker suppresses re-triggering within ~6 hours. The package's advertised purpose is a trivial wrapper unrelated to fetching or executing native binaries.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:27:47Z",
            "id": "IN-MAL-2026-015310",
            "import_time": "2026-08-05T15:19:44.094781301Z",
            "versions": [
                "35.3.2"
            ],
            "source": "amazon-inspector",
            "sha256": "32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a"
        }
    ]
}
References
Credits

Affected packages

npm / boxy-mm-advisor

Package

Name
boxy-mm-advisor
View open source insights on deps.dev
Purl
pkg:npm/boxy-mm-advisor

Affected ranges

Affected versions

35.*
35.3.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-mm-advisor/MAL-2026-13069.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "boxy-mm-advisor-35.3.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-Jz0FhvArEabecc8VP3zhMKTPKkyoJ4pE5AN9cVYN2OayfPDgKt6Uqg71+O6alOqmINoMVkCD3ZWYhloTe7q+0w==",
                "sha1": "518df33798cffade9af6e6c8308d68ae1c292e8c"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_init.js",
            "tlsh": "91a1865a1266701947b097e487275416f65bf6633380c2d8fbaca5984f7712483b2dfc",
            "sha256": "99c345f092aae42cbc85d111d6c49dd28b3c0a55c2f0ec351f08c8c250ca4b4c"
        }
    ]
}