MAL-2026-13077

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-render-unwrap/MAL-2026-13077.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13077

Published

2026-08-05T14:28:16Z

Modified

2026-08-05T15:52:11.544186545Z

Summary

Malicious code in boxy-render-unwrap (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (26755161d9a2ac85d670783fc7eb67383b08592dbb67899b916d3e521d560420)

On require of boxy-render-unwrap, index.js loads bootstrap.js which selects a platform-specific payload URL from a set of obfuscated mirror hosts assembled at runtime by joining split string arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT chunked-base64 fallback over subdomains under dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). bootstrap.js fetches the opaque binary via https.get, writes it to /tmp or %TEMP% under disguised names (dotnetdiag<rnd>.exe on Windows,.cache<rnd> on POSIX), chmods 0o755 on POSIX, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() or cmd /c start /b on Windows. A stamp file named.analyticsstate is written to mimic legitimate telemetry. Merely importing the package causes fetch-and-execute of attacker-controlled native code on the installer's machine.

Database specific

{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:28:16Z",
            "versions": [
                "35.7.9"
            ],
            "sha256": "26755161d9a2ac85d670783fc7eb67383b08592dbb67899b916d3e521d560420",
            "import_time": "2026-08-05T15:19:44.259831237Z",
            "id": "IN-MAL-2026-015313"
        }
    ]
}

References

https://www.npmjs.com/package/boxy-render-unwrap/v/35.7.9

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / boxy-render-unwrap

Package

Name: boxy-render-unwrap; View open source insights on deps.dev
Purl: pkg:npm/boxy-render-unwrap

Affected ranges

Affected versions

35.*

35.7.9

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-render-unwrap/MAL-2026-13077.json"

indicators

{
    "package_integrity": [
        {
            "filename": "boxy-render-unwrap-35.7.9.tgz",
            "hashes": {
                "sha1": "9743cd125bca45058bc6c06212179853bb322853",
                "sha512_sri": "sha512-jVJPZeW9Pmyfu4JAQQXdfZkUZjDFNU1Zn6qGT0c4K0Vlr7Apr7FBBjumnA0WbZ5UlfcVT213T7aYIQuWROdSrQ=="
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "sha256": "5293eadb2f345988abb868e92aa300d3c675aadb43bbb472a578939a567a95ef",
            "tlsh": "6aa195aa16a6701c4bb09bf4c7175415f65ae6633380c298f75ca9981fb35288372efc"
        }
    ]
}

cwes

[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]