boxy-esm-shims

{"modified":"2026-08-05T14:31:59Z","published":"2026-08-05T14:31:59Z","schema_version":"1.7.4","id":"MAL-2026-13042","summary":"Malicious code in boxy-esm-shims (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8f8bbecdfed31ec416782f6de127cb1003692978560504d748acd121b30fa3b)\nOn require() of the package, index.js loads _vendor.js which fetches an opaque binary from string-obfuscated Cloudflare Workers hosts (oob-worker.cf103-07.0.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64 fallback under *.wel1.ru (sdk.dl.wel1.ru). The downloaded bytes are written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe with unref(). Destination hostnames and the child_process require are assembled from split string fragments via Array.join to evade static matching, and the fetch is framed as telemetry with cover-story opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK). A TTL stamp file suppresses repeat execution.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-esm-shims"},"versions":["35.5.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"ca6331e5438ae6eb0538e339e031bed52c19145d42828f5dce898757e71b835b","tlsh":"03b1b85a166970188bb0ebe4c7175416f666f6633380c698fb9c55d41fb2124c3b2efc"}],"package_integrity":[{"filename":"boxy-esm-shims-35.5.5.tgz","hashes":{"sha1":"5bc5ac11150d06a72552fc97dffdd10440386d9a","sha512_sri":"sha512-zSQ3QKqloavh42Ql3VQMcCY1sK/pFJdztBMUuRPDpLpLhZIMKaF5Z4vGYhvHLiBtAjwlapz8g3eBwXF2ctR2eA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-esm-shims/v/35.5.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015338","import_time":"2026-08-05T15:19:45.625781492Z","modified_time":"2026-08-05T14:31:59Z","sha256":"c8f8bbecdfed31ec416782f6de127cb1003692978560504d748acd121b30fa3b","source":"amazon-inspector","versions":["35.5.5"]}]}}