MAL-2026-13087

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-temper/MAL-2026-13087.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13087
Published
2026-08-05T14:25:27Z
Modified
2026-08-05T15:52:16.587125826Z
Summary
Malicious code in boxy-temper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2)

index.js require()s bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are assembled at runtime via Array.join('') (e.g. 'oob-worker.cf103-070.workers.dev', 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf99-9b3.workers.dev'), downloads an opaque binary over HTTPS, writes it to /tmp on unix or %TEMP% on windows under disguised names (.cache<hex>, dotnetdiag_<hex>.exe), chmods 0755, and spawns it detached with stdio ignored via cp.spawn('/bin/sh', ['-c', fp+' &']) or the cmd equivalent. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel, issuing chunked TXT queries to attacker-controlled subdomains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), base64-reassembles the responses into a binary, writes it to disk and executes it. Hostnames are split into fragments and joined at runtime specifically to evade static string matching, and opt-out env vars are labeled as 'analytics' as a cover story. The package's advertised purpose is a 'boxy temper microservice adapter' but the main class is a no-op stub; the only real behavior is the loader. No hash or signature verification is performed on the downloaded payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015294",
            "import_time": "2026-08-05T15:19:43.124720628Z",
            "sha256": "b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2",
            "versions": [
                "35.1.5"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:25:27Z"
        }
    ]
}
References
Credits

Affected packages

npm / boxy-temper

Package

Name
boxy-temper
View open source insights on deps.dev
Purl
pkg:npm/boxy-temper

Affected ranges

Affected versions

35.*
35.1.5

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_bridge.js",
            "tlsh": "8ba1a89616aa71084bb097e487175415f66bf6a333c0c298fb9ca5981f731248372efc",
            "sha256": "34fb8db47dd70f15b2cd925fcab9469e7f967d8297e5415054f8fd39381d1e3a"
        }
    ],
    "package_integrity": [
        {
            "filename": "boxy-temper-35.1.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-/jxl6NJ+oirtlUqYFD1HASDEvqE/OKIYLrfL3GpWhgEqxIedY+20VSaZZsYcWveIN0i1HyUt4PhZlNLcpYZpsg==",
                "sha1": "0d3fb2a449255045e2bbb27d76dca3567a3d51ba"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-temper/MAL-2026-13087.json"