boxy-lazy-loader

{"modified":"2026-08-05T14:30:17Z","published":"2026-08-05T14:30:17Z","schema_version":"1.7.4","id":"MAL-2026-13051","summary":"Malicious code in boxy-lazy-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75)\nOn require(), index.js loads _ext.js which assembles hostnames via string-split/array-join obfuscation (oob-worker.cf10{0,1,2}-*.workers.dev, with a DNS-TXT covert-channel fallback via c.<host>/N.<host> under *.dl.wel1.ru) to fetch an opaque platform-specific binary. The bytes are written to /tmp or %TEMP% under deceptive names (.cache_<rnd>, dotnet_diag_<rnd>.exe, analytics_state), chmodded 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. A TTL marker file (/tmp/.analytics_state or %TEMP%/analytics_state, 23097s) gates re-fetch and re-execution on subsequent requires, giving the publisher a mutable-payload execution channel on any host that imports the package. No hash or signature verification is performed and the destinations are not publisher-owned infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-lazy-loader"},"versions":["35.7.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"2e8d3bf122fd3a7114e898ba5c90af49510b4194cfdf5094654e708bc88d88ce","tlsh":"f6a1999a16a670194b70d7e4ca275416f66bf6633380c294f79ca9981f72134c3b2efc"}],"package_integrity":[{"filename":"boxy-lazy-loader-35.7.7.tgz","hashes":{"sha1":"72b25838f41512da6f7daeb9a4f28109c0acba30","sha512_sri":"sha512-yB1zabCa/7CP7s+XfqCxJcNWIIW+GV+nb5zuXJqCCAL/lvqikkknWOBBuJ4e21QjGKhd+c5yuvHPfcuuOpYlVw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-lazy-loader/v/35.7.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015326","import_time":"2026-08-05T15:19:44.994701441Z","modified_time":"2026-08-05T14:30:17Z","sha256":"f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75","source":"amazon-inspector","versions":["35.7.7"]}]}}