MAL-2026-13099

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-wrapper-webpack-plugin/MAL-2026-13099.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13099
Published
2026-08-05T14:22:34Z
Modified
2026-08-05T15:52:22Z
Summary
Malicious code in boxy-wrapper-webpack-plugin (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50)

The package's main entrypoint (index.js) unconditionally requires./compat.js, whose top-level main() reconstructs obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) and vendor-lookalike domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) via array-join splits, downloads a platform-specific executable for linux/darwin/win32/arm64, writes it to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag.exe,.cache_), chmods 0755, and detached-spawns it via /bin/sh -c or cmd /c start. A DNS-TXT chunked base64 channel is used as a fallback delivery path. A second, structurally identical dropper is bundled at lib/telemetry.js (~80KB): base64-decoded payload chunks, HTTPS transport with endpoint rotation, DNS service discovery, obfuscated child_process access via require("child_"+"process"), obfuscated permission change via fs["chmod"+"Sync"], and cp.spawn("/bin/sh", ["-c", filePath+" &"]). The lure is named to resemble a webpack plugin, and hostnames and API references are split across array joins to evade string-based scanners.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-015276",
            "import_time":  "2026-08-05T15:19:42.096336089Z",
            "modified_time":  "2026-08-05T14:22:34Z",
            "sha256":  "835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50",
            "source":  "amazon-inspector",
            "versions":  [
                "35.5.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / boxy-wrapper-webpack-plugin

Package

Name
boxy-wrapper-webpack-plugin
View open source insights on deps.dev
Purl
pkg:npm/boxy-wrapper-webpack-plugin

Affected ranges

Affected versions

35.*
35.5.8

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "_compat.js",
            "sha256":  "25243c68f4c854ff33995584e306970e8e9344a295ff6f483fea08f9c6ff967c",
            "tlsh":  "2ca1869a16aa71198bb0e7e4c7174416f65bf6633380c2d4f79c69941f7212483b2efc"
        },
        {
            "path":  "lib/telemetry.js",
            "sha256":  "6644b57ba5bb106b000ec4f3546e2f14952b97cc3590078db471a7cee0dd0932",
            "tlsh":  "3e835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "boxy-wrapper-webpack-plugin-35.5.8.tgz",
            "hashes":  {
                "sha1":  "a0f5adfac28ec06d178b316b10e13625ab9926b1",
                "sha512_sri":  "sha512-0AjAQG3up+heRUpIdqDOHEtPQRHzhMsIPjKRGGkbhZ3fJIZldTArRJbfMNvhaJcpgnGcNRbo8Ff4Os8CPgiw6g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-wrapper-webpack-plugin/MAL-2026-13099.json"