boxy-client-loader

{"modified":"2026-08-05T14:34:28Z","published":"2026-08-05T14:34:28Z","schema_version":"1.7.4","id":"MAL-2026-13032","summary":"Malicious code in boxy-client-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319)\nOn require('boxy-client-loader'), index.js loads _platform.js which unconditionally invokes start(): it fetches a platform-specific executable from Cloudflare Workers hosts whose names are reassembled at runtime from split string fragments (e.g. 'oob-worker.cf101-adf.wo'+'rkers.dev'), with a DNS-TXT-over-base64 fallback that reads a chunk count from c.<domain> TXT and reassembles the payload from numbered N.<domain> TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to a temp path under masquerading names such as 'dotnet_diag_*.exe' and '.cache_*', chmod 0755 on POSIX, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. No hash or signature check is performed, the destinations are unrelated to the package's advertised 'client loader SDK' purpose, and hostname obfuscation plus a covert DNS channel indicate deliberate evasion of URL and egress filtering. Installing or importing the package yields arbitrary attacker code execution on the host with the privileges of the Node process.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-client-loader"},"versions":["35.8.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"8ef306a5c9d7a954d524b039e0fd18cc0cdd11b7ff6fc62f74145d09dca90599","tlsh":"85a1a79a116670184bb0ebe0c72b581af65af6633781c2d8f79c65885f7352483b2dfc"},{"path":"lib/telemetry.js","sha256":"8b9e12c150f981fa3e402a39fec4c4e29b114eecc4e2f389d3c8ae3ff803ee19","tlsh":"f1835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-client-loader-35.8.6.tgz","hashes":{"sha1":"2739d52bdb3a41067f1ae8841a94b8c06da218a5","sha512_sri":"sha512-gYMOCNll1cdjpy9iQkSmVOJDo1b8B/G1E8pZ8M6dcg6HBaEC6CyIVsoiuVdS3cF8aPeR9m7EfJr8L6eDwqLWzQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-client-loader/v/35.8.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015355","import_time":"2026-08-05T15:19:46.778720522Z","modified_time":"2026-08-05T14:34:28Z","sha256":"8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319","source":"amazon-inspector","versions":["35.8.6"]}]}}