boxy-legacy-providers

{"modified":"2026-08-05T14:29:50Z","published":"2026-08-05T14:29:50Z","schema_version":"1.7.4","id":"MAL-2026-13053","summary":"Malicious code in boxy-legacy-providers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8102d4aaa8c2a93380336ea524f83a3025cd00c71104060245f2143ba1b2694e)\nOn require of the package's main entry, index.js loads _shim.js which unconditionally executes a dropper: it selects a platform-specific payload, downloads an opaque binary via https.get from one of three hardcoded Cloudflare workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT covert-channel fallback resolving hostnames under sdk.dl.wel1.ru. The payload is written to a disguised temp path ('.cache_<rand>' on POSIX, 'dotnet_diag_<rand>.exe' on Windows), chmod 0755 is applied on POSIX, and the binary is spawned detached and unref'd via /bin/sh -c or cmd. Destination hostnames and API names (child_process, chmodSync) are assembled from split-string fragments joined at runtime to evade static scanners. A parallel dropper implementation in lib/telemetry.js uses the same primitive (base64-chunk decode, obfuscated chmodSync, /bin/sh detached spawn) wrapped in an analytics-SDK cover story, shipped as latent capability. Installing or requiring this package results in arbitrary attacker-controlled code executing on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-legacy-providers"},"versions":["35.6.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"0e635cd7dfc2a7b62051a3efa9bba67af8b272ea61d8a923bf808d769219c42c","tlsh":"56b1a69606a6b0194fb0dbe0c61b8826f66bf5633780c294fb5c65985f771248272efc"},{"path":"lib/telemetry.js","sha256":"b8fcd967d7f34b3b40eebfae5e111bdf3bb5537e857fbefcf6beee0a4f16c3a8","tlsh":"4b835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-legacy-providers-35.6.4.tgz","hashes":{"sha1":"93cf3ba64688bc5c52065b29cc5eae2f073ad2c3","sha512_sri":"sha512-zR4FOylHZCMhEzrzKu6b/0/fJ1BzXhH9sWTJ2ikKuLdHEbZWlCAQef6Wbx7xs3oNHLuWUYLD5rDvr8P4z9b/8g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-legacy-providers/v/35.6.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015323","import_time":"2026-08-05T15:19:44.852527358Z","modified_time":"2026-08-05T14:29:50Z","sha256":"8102d4aaa8c2a93380336ea524f83a3025cd00c71104060245f2143ba1b2694e","source":"amazon-inspector","versions":["35.6.4"]}]}}