MAL-2026-13083

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-sitree/MAL-2026-13083.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13083
Published
2026-08-05T14:25:52Z
Modified
2026-08-05T15:52:14.293400563Z
Summary
Malicious code in boxy-sitree (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc)

Requiring boxy-sitree triggers _shim.js, which selects a platform-specific binary path, fetches an executable from Cloudflare Workers hosts assembled by joining string fragments (oob-worker.cf*-*.workers.dev) with a DNS-TXT covert channel fallback that reassembles base64 chunks from numbered subdomains of *.dl.wel1.ru, writes the bytes to a temp file, chmods 0755, and spawns the binary detached via /bin/sh -c '<file> &' on Unix or cmd.exe start /b on Windows. Host and domain strings are split to defeat static matching, and the dropper is wrapped in analytics/diagnostics cover-story naming with opt-out environment variables. A second, unreferenced module lib/telemetry.js contains the same shell-spawn + chmod 0755 + base64 payload staging pattern under an 'Analytics SDK' framing, indicating a staged/parallel payload from the same actor. Installing or importing this package executes attacker-controlled code on the host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc",
            "id": "IN-MAL-2026-015297",
            "modified_time": "2026-08-05T14:25:52Z",
            "import_time": "2026-08-05T15:19:43.256611319Z",
            "source": "amazon-inspector",
            "versions": [
                "35.8.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-sitree

Package

Name
boxy-sitree
View open source insights on deps.dev
Purl
pkg:npm/boxy-sitree

Affected ranges

Affected versions

35.*
35.8.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "9fbb3d5957f1e9f5330ac5a9cf6760995e2b938ccfd10c683d5757c3939a411b",
            "path": "_shim.js",
            "tlsh": "a0a1889a16aa70194b70ebe4c6174415f65bf653338082d4f6ac69945fb3134c3b2efc"
        },
        {
            "sha256": "684cb37dbae63d5388a841fe6167b5bf391dc1a6b712f9a032912c3c319e2263",
            "path": "lib/telemetry.js",
            "tlsh": "5c835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-acZMHofo6kIQr4xMuD0Z+QhtPJEejchag+f2pQNMrb9HixV2bl8GY9gweV5unNRPX8AlyF+pUGfoRoHl81t3KQ==",
                "sha1": "cc93ed937eeabd5d84d4df847bed9f71797bcc75"
            },
            "filename": "boxy-sitree-35.8.7.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-sitree/MAL-2026-13083.json"