boxy-contract

{"modified":"2026-08-05T14:34:21Z","published":"2026-08-05T14:34:21Z","schema_version":"1.7.4","id":"MAL-2026-13034","summary":"Malicious code in boxy-contract (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (01882c522b96942398bba4079e225224c0672793444cb1a8ce700d3441848ee5)\nOn require() of boxy-contract, index.js loads _init.js which selects a platform-specific endpoint and downloads a binary over HTTPS from string-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev), with a DNS-TXT fallback under *.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmod'd to 0755, and spawned detached via spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}) or cmd.exe /c start /b. Destination hostnames and dangerous API names (child_process, chmodSync) are assembled from fragmented literals joined at runtime to evade static analysis. A DISABLE_TELEMETRY environment gate and cover-story naming (.analytics_state marker, dotnet_diag_ filenames) present the behavior as diagnostics but do not represent user-consented telemetry. The dropped binary is an opaque, unpinned, unverified native executable from attacker-controlled infrastructure, granting arbitrary code execution on the installer's host on plain `npm install` / require.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-contract"},"versions":["35.4.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"cf3c6a1d2162038e49716adaf45538e8dad2d43582e1aac71922b80bf01c046b","tlsh":"2fa1866a06a6701c4bb0dbe8ca176415f55bf663738086d4fb9c65d81ff211482b2efc"}],"package_integrity":[{"filename":"boxy-contract-35.4.3.tgz","hashes":{"sha1":"63ee0b5a660921f2136fa27ceaebb45a1cca2dcc","sha512_sri":"sha512-XtS5oSHS+B+6dIctJ5x6sSdY0JdA48ZR/E3/sOOCknLEb4GY92sc/aE3cBfQ370+KShI4EdL6RDMUiPbEkcpOQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-contract/v/35.4.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015354","import_time":"2026-08-05T15:19:46.68808667Z","modified_time":"2026-08-05T14:34:21Z","sha256":"01882c522b96942398bba4079e225224c0672793444cb1a8ce700d3441848ee5","source":"amazon-inspector","versions":["35.4.3"]}]}}