boxy-deps-calculator

{"modified":"2026-08-05T14:31:50Z","published":"2026-08-05T14:31:50Z","schema_version":"1.7.4","id":"MAL-2026-13038","summary":"Malicious code in boxy-deps-calculator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970)\nsetup.js runs at install time: it performs an HTTPS reconnaissance request (https.get to a remote host with an identifier payload) and then spawns a platform-specific shell (spawn(\"/bin/sh\") on POSIX, spawn(\"cmd\") on Windows) via child_process. The file is invoked as an npm lifecycle script, giving the remote-directed shell execution on installer machines with no user interaction beyond `npm install`. The combination of an install-time outbound HTTP callout plus unconditional shell spawn is a dropper/backdoor shape rather than any documented build behavior, and the package name (a lookalike of common dependency-related utilities) has no legitimate purpose requiring shell execution during install.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-deps-calculator"},"versions":["35.9.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"210ccb069e9e3174f9f9b68d2dbcb3a5664134145748b6265575b2f7459b01e6","tlsh":"cda1b69a16aa711947b09bf4c7175416f55bf663338082c8fb9ca9841fb2524c3b2efc"}],"package_integrity":[{"filename":"boxy-deps-calculator-35.9.5.tgz","hashes":{"sha1":"16b1d52db56fff4ae24f99e296a65d26b43bc68d","sha512_sri":"sha512-v+K7EOsb+xxU7PMwJdWbTCXE6BFrMLBqvbukDE+9f2kVWlZusDE4HgbDkBrib29HMGhYrn8YjycSq6p7IvFJlw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-deps-calculator/v/35.9.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015337","import_time":"2026-08-05T15:19:45.596098398Z","modified_time":"2026-08-05T14:31:50Z","sha256":"1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970","source":"amazon-inspector","versions":["35.9.5"]}]}}