MAL-2026-13090

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-test-host/MAL-2026-13090.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13090
Published
2026-08-05T14:25:35Z
Modified
2026-08-05T15:52:18.138508927Z
Summary
Malicious code in boxy-test-host (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb)

boxy-test-host@35.7.8 executes a remote binary dropper on any require() of the package. index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from a rotating set of hardcoded Cloudflare Workers endpoints (oob-worker.cf10*-*.workers.dev) with a DNS TXT record fallback pointing at *.dl.wel1.ru, writes it to a hidden /tmp path with a cache-style cover name (.cache, dotnetdiag), chmods it 0755, and spawns it detached via /bin/sh -c. The C2 hostnames and DNS fallback domains are reconstructed at runtime by joining split substring arrays to evade static host detection, and execution is gated by DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK environment variables plus a 21091-second stamp file to throttle re-runs. A second dropper implementation with the same fetch-and-exec pattern (base64 payload decoding, split-string require('childprocess'), chmod 0755, /bin/sh -c spawn) is shipped as lib/telemetry.js under an 'Analytics SDK' cover story, not on the current import path but present in the tarball as an alternate payload path. The fetched binary is opaque, unpinned, unverified, and delivered from non-publisher infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb",
            "id": "IN-MAL-2026-015295",
            "modified_time": "2026-08-05T14:25:35Z",
            "import_time": "2026-08-05T15:19:43.168667027Z",
            "source": "amazon-inspector",
            "versions": [
                "35.7.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-test-host

Package

Name
boxy-test-host
View open source insights on deps.dev
Purl
pkg:npm/boxy-test-host

Affected ranges

Affected versions

35.*
35.7.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "54a6d7a6146a450c2863ac8b0b7e8df5460d2a181ff8adbdcbd18270cd34bd10",
            "path": "_bootstrap.js",
            "tlsh": "b1a19a5a116a70184bb0e7e4c71b4816f65bf663378182c4fb9c65984fb35148372efc"
        },
        {
            "sha256": "2de7d5b2b77fa71331566d04819b7181d74449d061960fe78f73b09715c3fd2f",
            "path": "lib/telemetry.js",
            "tlsh": "a0835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Ie0+UNHfJzpFyl6wkx1itcsy7tCr/Wi5W9rAfK7r2SDSi3Mb62kK/pZdDhoP7poqNoCIsj0nYOIiPhfK4OHBKQ==",
                "sha1": "12438adbbe0651958ab9f26dfa7db57d24989228"
            },
            "filename": "boxy-test-host-35.7.8.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-test-host/MAL-2026-13090.json"