MAL-2026-13080

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-search-workspace-substrings/MAL-2026-13080.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13080
Published
2026-08-05T14:26:21Z
Modified
2026-08-05T15:52:12.996384090Z
Summary
Malicious code in boxy-search-workspace-substrings (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5e86dee583e9f4fb1f10351062e6b4a9ddb6b4eae29b59677c1e8f4bf04711b6)

On require() of the package, index.js silently loads loader.js (wrapped in an error-swallowing try/catch). loader.js reconstructs a set of destination hostnames at runtime via array split/join to evade static analysis — resolving to oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS TXT fallback covert channel on {sdk,ext.dl,pkg.dl,net.dl}.wel1.ru. It fetches a platform-specific binary over https.get, writes it to /tmp or %TEMP% under cover-story names (.cache<rand> on unix, dotnetdiag<rand>.exe on Windows, with an.analyticsstate marker file), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe so the child survives after the parent process exits. There is no version pinning, no hash or signature verification, and the destinations are not the package's publisher infrastructure. The package's stated purpose is a trivial no-op utility, which is inconsistent with fetching and executing a native binary at import time. Opt-out is gated only on DISABLETELEMETRY / DONOT_TRACK environment variables, which do not prevent execution in a default install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5e86dee583e9f4fb1f10351062e6b4a9ddb6b4eae29b59677c1e8f4bf04711b6",
            "id": "IN-MAL-2026-015300",
            "modified_time": "2026-08-05T14:26:21Z",
            "import_time": "2026-08-05T15:19:43.440943105Z",
            "source": "amazon-inspector",
            "versions": [
                "35.8.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-search-workspace-substrings

Package

Name
boxy-search-workspace-substrings
View open source insights on deps.dev
Purl
pkg:npm/boxy-search-workspace-substrings

Affected ranges

Affected versions

35.*
35.8.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "c21dc7d408ef11f9bf959689800237d8a45b353e187c403ff96973060440a0b7",
            "path": "_loader.js",
            "tlsh": "78a1956a026570194b70d7e4c6175415f66af6637680c1d4f7aca9881fb3224c3f2eec"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-mKGCO8LVwoml8XO9t4ZeW2Gr+spz/YtuJQ8TElINo5B6KkOZI7+MMuYYZ3r/a28dlXUA0HuXIyJ55MdcbVKtwQ==",
                "sha1": "2b92d1245ee6dc7bd8ec788a96ef1d21196ffd65"
            },
            "filename": "boxy-search-workspace-substrings-35.8.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-search-workspace-substrings/MAL-2026-13080.json"