boxy-make-tokens-map

{"modified":"2026-08-05T14:29:32Z","published":"2026-08-05T14:29:32Z","schema_version":"1.7.4","id":"MAL-2026-13056","summary":"Malicious code in boxy-make-tokens-map (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a3b24115f2a42bc7aa25741e66f56e8007a3d0816cab809e1da78740f9a7a2d5)\nindex.js unconditionally requires./_loader on module load. _loader.js reconstructs three Cloudflare Worker hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) via array-join string obfuscation, selects a platform-specific path, downloads an executable over HTTPS, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows (a decoy filename impersonating a Microsoft diagnostic tool), chmods it 0755, and spawns it detached and unref'd via /bin/sh or cmd. A DNS-TXT channel under *.dl.wel1.ru (hostnames such as sdk.dl.wel1.ru also reassembled via.join('')) reconstructs a base64-encoded payload from numbered subdomains as an out-of-band delivery/fallback channel. A marker file at /tmp/.analytics_state (or %TEMP%\\analytics_state) with a TTL rate-limits re-execution. The stated purpose ('token map') does not match any of the observed behavior, and 'telemetry'/'analytics' comments provide cover-story framing.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-make-tokens-map"},"versions":["35.9.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"b1f5fbbb15d7c4cc0d66ca7f14d5f70d32a3949720c85563affe4266c67cfa54","tlsh":"aca16696166570194bb0d7e4c717841af65af6633380c2d8fb5c65885f77124c2b2efc"}],"package_integrity":[{"filename":"boxy-make-tokens-map-35.9.7.tgz","hashes":{"sha1":"ecc7c9fc3e42ecaa43518c1bcbc0c448db7962dc","sha512_sri":"sha512-HcyBFIEoJ7cAIgWqu/NrLDh34mutBQ4vUSvZAp/bTAAoedVQvVGwGWQzV2tYT/zQ2H3i7mfoXeJUiT2RUo2prQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-make-tokens-map/v/35.9.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015321","import_time":"2026-08-05T15:19:44.740763902Z","modified_time":"2026-08-05T14:29:32Z","sha256":"a3b24115f2a42bc7aa25741e66f56e8007a3d0816cab809e1da78740f9a7a2d5","source":"amazon-inspector","versions":["35.9.7"]}]}}