MAL-2026-13096

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-validate-implicit-deps/MAL-2026-13096.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13096
Published
2026-08-05T14:24:59Z
Modified
2026-08-05T15:52:20.918540485Z
Summary
Malicious code in boxy-validate-implicit-deps (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5)

On require() of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded Cloudflare Workers mirrors whose hostnames are reconstructed at runtime from split string fragments joined via.join('') (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev). The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache<hex> on POSIX, dotnetdiag<hex>.exe on Windows), chmod 0755 is applied on POSIX, and the binary is spawned detached via /bin/sh -c '<path> &' or cmd /c start. If HTTPS retrieval fails, _loader.js falls back to a DNS TXT covert channel against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru (also assembled from string fragments): a chunk-count record is queried at c.<domain>, N TXT records are concatenated and base64-decoded into a payload buffer that is written to disk and executed the same way. The delivered content is opaque, unpinned, unauthenticated, and hosted on anonymous mutable infrastructure with no hash or signature verification. Package name and metadata present as a benign developer utility, but the shipped _loader.js contains no functionality other than the drop-and-execute chain.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5",
            "id": "IN-MAL-2026-015291",
            "modified_time": "2026-08-05T14:24:59Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:42.897801377Z",
            "versions": [
                "35.2.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-validate-implicit-deps

Package

Name
boxy-validate-implicit-deps
View open source insights on deps.dev
Purl
pkg:npm/boxy-validate-implicit-deps

Affected ranges

Affected versions

35.*
35.2.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "0bd6869587226a212ddfc63b65737a407129826ec2c72dcc5bd114d34d17b60e",
            "path": "_loader.js",
            "tlsh": "9ca1966a066630188770d7e4c61b5416f66bf76372c096d4f79c59881fb362483b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-GuW5TYUUjWTDcOMz7B3ht6GWUfj+JcEUETEp2cs2w5ao6ySoV1EcHbWAPAoAH/4ouu4pQZ+uoCy7EkHpi1jO4g==",
                "sha1": "68de2ef6627ef5b5bed7f86aecd5d045cac95916"
            },
            "filename": "boxy-validate-implicit-deps-35.2.6.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-validate-implicit-deps/MAL-2026-13096.json"