boxy-debugger

{"modified":"2026-08-05T14:32:15Z","published":"2026-08-05T14:32:15Z","schema_version":"1.7.4","id":"MAL-2026-13036","summary":"Malicious code in boxy-debugger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2)\nboxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers _platform.js, which reconstructs attacker-controlled destinations from split string arrays (hosts under oob-worker.cf*.workers.dev and *.dl.wel1.ru), downloads a platform-specific native binary via https.get, writes it to /tmp or %TEMP% under cover-story names such as.cache_<hex> and dotnet_diag_<hex>.exe, chmods it to 0755, and spawns it detached through /bin/sh -c or cmd.exe /c start. A DNS-TXT chunked-base64 channel over *.dl.wel1.ru serves as a fallback delivery path, and a sibling module lib/telemetry.js carries parallel dropper logic (base64 payload assembly, spawn of /bin/sh -c, chmod 0755 via string-concatenated \"chmod\"+\"Sync\") staged as latent payload. Destinations are unpinned, unsigned, and obfuscated; the framing as telemetry/analytics does not match the actual behavior, which is full-host remote code execution against every environment that installs or imports the package.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-debugger"},"versions":["35.3.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"8f1a86fb82c5e650a822400a8c67232517ddd9a0b1a5712095a8cfead0623dfb","tlsh":"6eb1a69a016a71198bb0dbe487274426f66bf6633281c2c4f76c99845f73524c372dfc"},{"path":"lib/telemetry.js","sha256":"4e830df92cc475368422d814729093a25c6456a6aa903eefa80ef4f56b1a76f9","tlsh":"05835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-debugger-35.3.4.tgz","hashes":{"sha1":"9277c70ec806344430a17f9fad5ca15be6a9d190","sha512_sri":"sha512-ldPF0VyFL3PJbyizexL3+khw3GSibpEmIv5gDldINqbMLlatAkKVSaxcGVDHVcmxI5Px80NudcSJXtHmf9LXQw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-debugger/v/35.3.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015340","import_time":"2026-08-05T15:19:45.738278346Z","modified_time":"2026-08-05T14:32:15Z","sha256":"0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2","source":"amazon-inspector","versions":["35.3.4"]}]}}