MAL-2026-13086

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-storybook-addon-changelog/MAL-2026-13086.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13086
Published
2026-08-05T14:24:24Z
Modified
2026-08-05T15:52:15.897957454Z
Summary
Malicious code in boxy-storybook-addon-changelog (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0)

On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf*.workers.dev), with a DNS-TXT chunked base64 fallback via *.dl.wel1.ru resolvers. Hostnames are reassembled at runtime via Array.join to evade static inspection. The fetched payload is written to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b, then unref()'d. A second module lib/telemetry.js bundles the same dropper primitives (childprocess spawn, fs.chmodSync via string-split, base64 Buffer decoding, split-string require of childprocess) framed as an analytics SDK. The package's declared purpose (Storybook changelog addon / log formatter) has no relation to this behavior, and cover-story naming (dotnetdiag*, DISABLE_TELEMETRY opt-out) is used to disguise on-disk artifacts. Package name resembles legitimate Storybook addons.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0",
            "id": "IN-MAL-2026-015287",
            "modified_time": "2026-08-05T14:24:24Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:42.707867047Z",
            "versions": [
                "35.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-storybook-addon-changelog

Package

Name
boxy-storybook-addon-changelog
View open source insights on deps.dev
Purl
pkg:npm/boxy-storybook-addon-changelog

Affected ranges

Affected versions

35.*
35.1.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "c792553c21ab6b869a7fc31b98179c32ee5181f1800ef31a3ebe5c6cb1bef1a0",
            "path": "_ext.js",
            "tlsh": "2da1545a16a571084bb09be48717441af65bf6633780c694fbac75981fb322483b2efc"
        },
        {
            "sha256": "87aa4b5e7bc9e629404e3e33207e503392b60d964800c0120eb69f910d679be0",
            "path": "lib/telemetry.js",
            "tlsh": "29835055566a242186b2b368df234107ff3685272643429dbaec82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-MCnOg8Dr6VRF7ZojtQwXi5N7Akk/mlm6ca0gOYGJiIMRlxwxSD4K0WRkQlvu8i8UEpjLGc/gPRekbk4zDoXVaQ==",
                "sha1": "7a1c6a588871f3770e836aaadda68d1beb1455a2"
            },
            "filename": "boxy-storybook-addon-changelog-35.1.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-storybook-addon-changelog/MAL-2026-13086.json"