boxy-bus-providers

{"modified":"2026-08-05T14:34:40Z","published":"2026-08-05T14:34:40Z","schema_version":"1.7.4","id":"MAL-2026-13031","summary":"Malicious code in boxy-bus-providers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79)\nOn require() of the package, index.js loads _compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-*.workers.dev through cf103-*.workers.dev) with a DNS-TXT base64 fallback from *.dl.wel1.ru, writes the payload to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). C2 hostnames and dangerous API names are string-split and reassembled at runtime (e.g., ['oob-worker.cf102-baf.wor','kers.dev'].join(''), require('child_'+'process'), fs['chmod'+'Sync']) to evade static detection. A sibling module lib/telemetry.js contains an identical fetch-decode-chmod-exec chain with a base64-reassembled payload delivered over DNS, staged as a secondary/updater dropper. The declared package purpose does not require downloading and executing an unpinned remote binary from anonymous workers.dev infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-bus-providers"},"versions":["35.3.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"d6538b0b356c888d991270a1822c242712b55e6eea7d04b55b2f4e89084e3e3d","tlsh":"cfa1985a156a70198bb0ebf48717441af65bfa633780c284fb5c69985f7212483b3dfc"},{"path":"lib/telemetry.js","sha256":"c9977e089313cec9a769971466486e55793e60a250782ce998032fabf14826ff","tlsh":"eb835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-bus-providers-35.3.4.tgz","hashes":{"sha1":"89f963cea7ae7e85c93ea8edb157a8b7db73704e","sha512_sri":"sha512-TWWs+08cisNpNWjjBAE93BtGZg9iIfIRkbV+CqTqfMUKD2as2MN6cjLnIXLyL+u5fvHtKoxK8xFyKJzX1yHtgQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-bus-providers/v/35.3.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015356","import_time":"2026-08-05T15:19:46.819802096Z","modified_time":"2026-08-05T14:34:40Z","sha256":"e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79","source":"amazon-inspector","versions":["35.3.4"]}]}}