MAL-2026-13094

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-use-calls/MAL-2026-13094.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13094
Published
2026-08-05T14:23:06Z
Modified
2026-08-05T15:52:19.850031721Z
Summary
Malicious code in boxy-use-calls (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (41e7b8d0b1d87131f56439454c512c68c367ed421c04c7a4bc165c7aeb6acdd6)

index.js unconditionally requires bridge.js, whose top-level main() runs on import. bridge.js selects a platform-specific payload path, downloads an opaque binary via https.get from one of several string-split Cloudflare-Workers hosts assembled by.join('') (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), writes it to a disguised filename under /tmp or %TEMP% (e.g..cache<hex>, dotnetdiag<hex>.exe), chmods it 0755, and detached-spawns it via /bin/sh -c or cmd /c start with.unref(). A fallback channel queries DNS TXT records under c.<domain> and sequentially-numbered subdomains of *.dl.wel1.ru to reassemble a base64-chunked payload when HTTPS is blocked. A 21376-second replay-suppression stamp is written under an 'analyticsstate' key. No pinning, no signature check, no publisher-matching source. A separate lib/telemetry.js file presents an 81 KB 'analytics SDK' that is never referenced by index.js or bridge.js and shares DISABLETELEMETRY/ANALYTICSOPTOUT env-var names with _bridge.js, serving as cover-story camouflage for the dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "41e7b8d0b1d87131f56439454c512c68c367ed421c04c7a4bc165c7aeb6acdd6",
            "id": "IN-MAL-2026-015280",
            "modified_time": "2026-08-05T14:23:06Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:42.291496437Z",
            "versions": [
                "35.1.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-use-calls

Package

Name
boxy-use-calls
View open source insights on deps.dev
Purl
pkg:npm/boxy-use-calls

Affected ranges

Affected versions

35.*
35.1.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "e02d018431751618c654deeab717ec45234c7e3bc2f1abc296536124a46fb311",
            "path": "_bridge.js",
            "tlsh": "52a1765a16aa71188bb0e7e0c7174415f65af6633391c284fb9c65d45fb312483b2efc"
        },
        {
            "sha256": "49904d944277fc74ae1a1df5e10943dbab4e2712c84d8d489c4805557f843cd5",
            "path": "lib/telemetry.js",
            "tlsh": "eb835055566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Ar67WfKFyz2EDla3WkVbV1rboIr7BhdG9/x8Nj4cDmgZATHMb56+Wx/WZV50RelYtdpCq5UtIDxdhyQZCxGFMg==",
                "sha1": "f6542c813c519a1556ca36e3eee47e24ec2e0d20"
            },
            "filename": "boxy-use-calls-35.1.8.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-use-calls/MAL-2026-13094.json"