MAL-2026-13095

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-use-what-changed/MAL-2026-13095.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13095
Published
2026-08-05T14:24:05Z
Modified
2026-08-05T15:52:20.147128992Z
Summary
Malicious code in boxy-use-what-changed (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667)

On require() of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT-record fallback under dl.wel1.ru (sdk.dl.wel1.ru, net.dl.wel1.ru). Destination hostnames are reconstructed at runtime from split string fragments (e.g. ["oob-worker.cf","100-416.worke","rs.dev"].join("")) to evade static string matching. The fetched payload is written to a disguised path in /tmp or %TEMP% (.cache<hex> or dotnetdiag<hex>.exe), chmod 0o755, and executed detached via cp.spawn("/bin/sh", ["-c", path+" &"], {detached:true}) or the Windows cmd equivalent. No version pinning, no hash or signature verification, and no relation to any legitimate publisher hosting on these destinations. A second file, lib/telemetry.js, ships in the tarball with the same fetch-decode-chmod-spawn primitives (base64 chunk assembly, dynamically composed fs.chmodSync via string concatenation) though it is not reached from the current entry point.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667",
            "id": "IN-MAL-2026-015285",
            "modified_time": "2026-08-05T14:24:05Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:42.553839775Z",
            "versions": [
                "35.4.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-use-what-changed

Package

Name
boxy-use-what-changed
View open source insights on deps.dev
Purl
pkg:npm/boxy-use-what-changed

Affected ranges

Affected versions

35.*
35.4.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "b2862b99483c5b2c503d76522ada7ae9d4259ad7d0f3555ea3e1f45c8281caf6",
            "path": "_ext.js",
            "tlsh": "dfa1745a12a670084bb0a7e4c7074826f65bf6a33781d2d4fb5c65885f7762483b2efc"
        },
        {
            "sha256": "69730d3c2c89eca01ef95426a17a58c69b2db7a41bc53d3e5a2c75932afd079d",
            "path": "lib/telemetry.js",
            "tlsh": "93835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Ukx4YBRYa/kxMAfZBCgQxU1Vmc4I/RY68eMuu8Ka6T2CXlvFJh6JbD1lVpXHYmG1xh691oRMpwnF87giie2yww==",
                "sha1": "e0a3bc81cf14b42ab0702fb4d29ed206d918f0b2"
            },
            "filename": "boxy-use-what-changed-35.4.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-use-what-changed/MAL-2026-13095.json"