boxy-loader

{"modified":"2026-08-05T14:30:10Z","published":"2026-08-05T14:30:10Z","schema_version":"1.7.4","id":"MAL-2026-13055","summary":"Malicious code in boxy-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c)\nOn require('boxy-loader'), index.js loads _adapter.js which executes setup() at module top level. setup() picks a platform-specific remote path, downloads an opaque executable from obfuscated Cloudflare Workers hosts (hostnames such as oob-worker.cf*.workers.dev are assembled at runtime by joining split string fragments), writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. If the HTTPS fetch fails, loadViaDns() falls back to resolveTxt('c.<domain>') to obtain a chunk count and then resolveTxt('<i>.<domain>') against *.dl.wel1.ru, base64-decodes the concatenated TXT records, writes the resulting bytes to disk and executes them — a DNS-tunneled payload channel designed to survive HTTPS egress filtering. Both the CDN host list and the DNS discovery domains are constructed from split string fragments to hide destinations from string-matching scans. The fetched executable is not shipped in the tarball, is not pinned or hash-verified, and is unrelated to any documented package purpose; the staging filename decoys (.cache_<hex>, dotnet_diag_<hex>.exe) further conceal it.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-loader"},"versions":["35.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"f9547fc2b5b53747fecdb6e8733c5883fc5a8ee36e745b35e0b5590618e73f7d","tlsh":"d5a1b79a16a670184bb0a7e0c7075829f65af6633780c2d4f79c66845f735248272efc"}],"package_integrity":[{"filename":"boxy-loader-35.4.2.tgz","hashes":{"sha1":"482e5364aef347a274998d9f2484844716dc001b","sha512_sri":"sha512-X/ClkxrXSKITdG1AsUQex4Je1b/g06WWRD1pNUqkW6QUBejtuEJj5Cu+RQOpZ6ZGUYpGMTYIgsy4OY3OcYt74A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-loader/v/35.4.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015325","import_time":"2026-08-05T15:19:44.943838614Z","modified_time":"2026-08-05T14:30:10Z","sha256":"bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c","source":"amazon-inspector","versions":["35.4.2"]}]}}