boxy-fixture-pendel

{"modified":"2026-08-05T14:31:44Z","published":"2026-08-05T14:31:44Z","schema_version":"1.7.4","id":"MAL-2026-13046","summary":"Malicious code in boxy-fixture-pendel (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830)\nOn require('boxy-fixture-pendel'), index.js loads _support.js which asynchronously downloads a platform-specific binary from obfuscated destinations assembled at runtime via string-array.join('') — oob-worker.cf103-070.workers.dev and related Cloudflare Workers subdomains, with a DNS-TXT-record fallback channel that reassembles a base64-encoded binary from numbered TXT records under net.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under cover-story filenames (dotnet_diag_*.exe,.cache_*), chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached: true}) or the Windows equivalent. There is no hash or signature verification, and the download destinations are unrelated to the package publisher. A second copy of the same dropper (split-concat hosts, /bin/sh -c spawn, chmod 0755, base64 buffer reassembly) is bundled in lib/telemetry.js under 'Analytics SDK' scaffolding; it is present in the tarball but not reached from index.js in this version. TTL caching and env-var opt-outs are included to reduce repeat triggering and aid evasion.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-fixture-pendel"},"versions":["35.8.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"23482aa780951b434609eccb8d05cd2659f0395e58face84df121de9c2ee99c3","tlsh":"0aa1a89a16aa70084bb097e087175416f65ff66337c0c2d4fb5ca5981f7612483b2efc"},{"path":"lib/telemetry.js","sha256":"f544c43d88404e051c17e60ccd0d7ce6f3dbd1b019b9a4d8e1e9b5fd3669bf99","tlsh":"d7835f55566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-fixture-pendel-35.8.9.tgz","hashes":{"sha1":"af458e679e57d99d988ee1810a61155252afef8e","sha512_sri":"sha512-lBinQX49FRckw3KoBjvLGbnI6dXW/aWiPuhRq7fXBsfn7pi5tZZMfHbamDb6Tn5w/6KEkdOkAGYW9UDoPzzrqQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-fixture-pendel/v/35.8.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015336","import_time":"2026-08-05T15:19:45.541339587Z","modified_time":"2026-08-05T14:31:44Z","sha256":"dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830","source":"amazon-inspector","versions":["35.8.9"]}]}}