MAL-2026-13093

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-tree-providers/MAL-2026-13093.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13093
Published
2026-08-05T14:24:43Z
Modified
2026-08-05T15:52:19.536993001Z
Summary
Malicious code in boxy-tree-providers (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5)

On any require()/import of the package, index.js loads ext.js which reconstructs four Cloudflare Workers destinations (oob-worker.cf*.workers.dev) via split-string concatenation, fetches a platform-specific executable via https.get, writes it to /tmp or %TEMP% under masquerade names such as dotnetdiag_*.exe and.cache_*, chmods it 0755, and spawns it detached via spawn('/bin/sh',...) or spawn('cmd',...). If HTTPS retrieval fails, a DNS-TXT loader (loadViaDns) reassembles a base64-encoded payload from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. No integrity or signature check is performed. lib/telemetry.js contains additional dropper scaffolding (base64 buffer decode, dynamically constructed chmodSync, spawn('/bin/sh', ['-c', filePath + ' &'])) staged in the tarball. Package advertises itself as reusable UI/tree-provider components; fetching and executing arbitrary remote binaries is inconsistent with that purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5",
            "id": "IN-MAL-2026-015289",
            "modified_time": "2026-08-05T14:24:43Z",
            "import_time": "2026-08-05T15:19:42.787210319Z",
            "source": "amazon-inspector",
            "versions": [
                "35.3.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-tree-providers

Package

Name
boxy-tree-providers
View open source insights on deps.dev
Purl
pkg:npm/boxy-tree-providers

Affected ranges

Affected versions

35.*
35.3.9

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "926b128df2a5638a29ea4b1f9cea5f848bbbf51b832cfa75cf82f39a42df7074",
            "path": "_ext.js",
            "tlsh": "06a1966a1666701887b0d7e8c7175416f65bf76337c0c284fb9ca9981f7212882b2efc"
        },
        {
            "sha256": "22a33e80fc247a7e22f524b321fb2d658c91c06feb9ce9d1e002072855ff1163",
            "path": "lib/telemetry.js",
            "tlsh": "a3835055566a242186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-rn/+VJMbj4UhU8e8tOfNeDCT3rv6oqgkBM1fy56QIyqFxEwRmQ7TWmr5uMPuDKVbZxWW5LySvfdauBNX1FrZfg==",
                "sha1": "d8435d5008e7bc0713625fb9c3b6a3dbb37a6e01"
            },
            "filename": "boxy-tree-providers-35.3.9.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-tree-providers/MAL-2026-13093.json"