MAL-2026-13298

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-block/MAL-2026-13298.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13298
Published
2026-08-05T15:26:39Z
Modified
2026-08-05T16:50:40.851821804Z
Summary
Malicious code in dolyame-boxy-block (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce)

dolyame-boxy-block@35.5.2 ships a _runtime.js module that is unconditionally required from index.js at load time. On import, _runtime.js reconstructs attacker-controlled hostnames from split string arrays (e.g. ["oob-wor","ker.cf99-9b3.workers.dev"].join("") producing oob-worker.cf99-9b3.workers.dev, and similar for oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), performs an https.get to a platform-specific endpoint, writes the returned bytes to /var/tmp or %TEMP% under a decoy filename (.cache_<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmod 0755s the file, and spawns it detached via /bin/sh -c "<path> &" or cmd.exe with stdio:"ignore" and .unref(). If the HTTPS mirrors fail, a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru retrieves a base64-encoded payload chunked across multiple TXT records (c.<domain>, 0.<domain>, 1.<domain>...), reassembles it, and executes it through the same write-and-spawn sink. The advertised purpose ("boxy block" UI library) does not match the shipped behavior; the hostnames are obfuscated to evade static string search; the fetched binary is unpinned, unhashed, and unsigned. Any consumer that require()s or imports the package triggers full-host remote code execution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.5.2"
            ],
            "id": "IN-MAL-2026-015700",
            "import_time": "2026-08-05T16:13:33.675756603Z",
            "modified_time": "2026-08-05T15:26:39Z",
            "source": "amazon-inspector",
            "sha256": "919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-block

Package

Name
dolyame-boxy-block
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-block

Affected ranges

Affected versions

35.*
35.5.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "dolyame-boxy-block-35.5.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-j0ExXgS0MqK3o4RQII9aVIVReNPlHt/oIp39dFUo+O3LLc+RFTxeCDioYV01juSyasnat/sp7uhhW7rJh+finA==",
                "sha1": "ba695bef60d1b6bdc669ad2b5606be0a336853e0"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_runtime.js",
            "tlsh": "62b1a55a11a6b0184fb0e7f4c717482af65bfa6336808294f75ca5985f7352483b2efc",
            "sha256": "ec0ff5c1b6271212304b8dac62ffd1e0bf64c93b472838a1d1889f2ba22e0cb3"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-block/MAL-2026-13298.json"