MAL-2026-13534

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-pwa-c-boxy-di/MAL-2026-13534.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13534
Published
2026-08-07T12:31:52Z
Modified
2026-08-07T13:20:18Z
Summary
Malicious code in ded-pwa-c-boxy-di (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037)

On require('ded-pwa-c-boxy-di'), index.js loads loader.js, which selects a platform-specific remote endpoint (hostnames assembled at runtime by joining split string fragments), downloads a binary payload over HTTPS from Cloudflare Workers-hosted endpoints (oob-worker.cf100-416.workers.dev and siblings) with a DNS-TXT base64 fallback channel via sdk.dl.wel1.ru, writes the bytes to a temporary path under a disguised name (e.g. dotnet_diag.exe,.cache_), chmods the file to 0755, and spawns it detached via /bin/sh -c or cmd. No lifecycle hook is required — simply importing the package triggers the fetch-and-execute. Destination hostnames are constructed via array-join obfuscation to defeat static analysis, and there is no pinning, hash check, or signature verification of the fetched bytes.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017018",
            "import_time": "2026-08-07T12:51:22.398045512Z",
            "modified_time": "2026-08-07T12:31:52Z",
            "sha256": "eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037",
            "source": "amazon-inspector",
            "versions": [
                "35.2.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ded-pwa-c-boxy-di

Package

Name
ded-pwa-c-boxy-di
View open source insights on deps.dev
Purl
pkg:npm/ded-pwa-c-boxy-di

Affected ranges

Affected versions

35.*
35.2.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_loader.js",
            "sha256": "410a6d5754082af62d86be897632a5e402e84f17b2894ea9c6e3c17bcf6b3d6f",
            "tlsh": "8ba1b75612a670184bb0dbe4cb174816f65bf6633781c288f75ca5885f7352883b2efc"
        }
    ],
    "package_integrity": [
        {
            "filename": "ded-pwa-c-boxy-di-35.2.2.tgz",
            "hashes": {
                "sha1": "9aa9663c57dc91fc34f6e62fccbd1ee24615301d",
                "sha512_sri": "sha512-Rdz7+AjKavvXQZxNz+QDxnVkHPSqiC1tx1bvEFZ78Or950whsOFgItW2aRKnfKYXMdsMRXNLbyDq3iANT85Aqg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ded-pwa-c-boxy-di/MAL-2026-13534.json"