MAL-2026-13299

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-component-story-name/MAL-2026-13299.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13299
Published
2026-08-05T15:26:05Z
Modified
2026-08-05T16:50:41.017331913Z
Summary
Malicious code in dolyame-boxy-component-story-name (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32)

On require() of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments (e.g. 'oob-work'+'er.cf101-ad'+...+'workers.'+'dev'), fetches a platform-specific executable, with a DNS-TXT chunked fallback via '*.dl.wel1.ru' (also reconstructed from fragments like ['sdk','.dl.wel1','.r','u'].join('')), writes it to a hidden randomized filename under /tmp (or %TEMP%), sets mode 0755, and spawns it detached and orphaned via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution is gated by a TTL stamp file to run at most once per ~23000 seconds. A parallel dropper implementation ships in lib/telemetry.js with additional obfuscation (require('child'+'process'), fs['chmod'+'Sync'], base64-assembled payload chunks) framed as an APM telemetry SDK. The package's stated purpose is a reusable component library, so the fetch-and-execute pipeline is entirely covert. The delivered bytes are attacker-controlled and opaque, yielding arbitrary code execution on the installer's host on import.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:26:05Z",
            "versions": [
                "35.3.3"
            ],
            "import_time": "2026-08-05T16:13:33.260395096Z",
            "id": "IN-MAL-2026-015696"
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-component-story-name

Package

Name
dolyame-boxy-component-story-name
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-component-story-name

Affected ranges

Affected versions

35.*
35.3.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "0a787e5e7af0744a58968391d6dbd88e17f4f21b",
                "sha512_sri": "sha512-9DMLT9HNxHX7IIeT5VSYLeRrHwdpJb/1A3k7i0UBhEmm0H1RLtJ5LkU+txFUlr/BCTxTpC37F6AMXcty9P4wRg=="
            },
            "filename": "dolyame-boxy-component-story-name-35.3.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_support.js",
            "sha256": "4cdcc970ed1547f9b2f35df459670912590eb8fcbc0627d5c2ffb66a802b8ffc",
            "tlsh": "ffb1a69616aa70294f7097e0c61b8426f56ff66337c0c294f79ca9885f725288371dfc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "de26336e36fae14d1112bc3215a40d876d70b2e8d89a13b9b55ee369cf61a5b6",
            "tlsh": "84835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-component-story-name/MAL-2026-13299.json"