boxy-add-link

{"modified":"2026-08-05T14:34:12Z","published":"2026-08-05T14:34:12Z","schema_version":"1.7.4","id":"MAL-2026-13029","summary":"Malicious code in boxy-add-link (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701)\nOn require('boxy-add-link'), index.js loads _compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), retrieves an opaque binary over https.get, writes it to /tmp/.cache_<hex> on unix or %TEMP%\\dotnet_diag_<hex>.exe on windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, the module reassembles a base64-encoded payload from sequential DNS TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) and feeds the same write-chmod-spawn pipeline. Hostnames and API names (child_process, chmodSync) are constructed at runtime from split fragments to evade string scanning. A second, structurally identical dropper is staged in lib/telemetry.js but is not reachable from the main entry in this version.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-add-link"},"versions":["35.7.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"1a9eb958d8edf30a34b094b4ef56d8ecccf1f1d1bcf6df2c5ddc4559c536187e","tlsh":"50a1735a16a971184bb0abe4c717541af66bf2633781c294f79ca8941f7313483b2efc"},{"path":"lib/telemetry.js","sha256":"eb6d210b85718006203d01133b598cf7b4dbb14de3ce70482ca782309259cd35","tlsh":"c8835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-add-link-35.7.5.tgz","hashes":{"sha1":"95a6918c7dff10b7eec7d8872658464e4d4798c8","sha512_sri":"sha512-/4w6HujPSo39wJ3uJpmCvqIg9fsZbLFd3yRqJmLvb3APRs/npKU7lU81BkEtZL5hakPn+PAQBBcFe+7rVd85mA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-add-link/v/35.7.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015353","import_time":"2026-08-05T15:19:46.602914499Z","modified_time":"2026-08-05T14:34:12Z","sha256":"8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701","source":"amazon-inspector","versions":["35.7.5"]}]}}