boxy-maker-legacy

{"modified":"2026-08-05T14:29:40Z","published":"2026-08-05T14:29:40Z","schema_version":"1.7.4","id":"MAL-2026-13060","summary":"Malicious code in boxy-maker-legacy (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b)\nOn require of the package, _runtime.js runs a bootstrap routine that downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, cf100-416, cf103-070, cf101-adf), writes it to /tmp or %TEMP% under disguised names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmod 0755, and detach-executes it via /bin/sh -c or cmd /c start. Destination hostnames are assembled at runtime by joining fragmented string arrays (e.g. [\"oob-worker\",\".cf99-\",\"9b3.\",\"work\",\"ers.\",\"dev\"].join(\"\")) to defeat static string matching. If HTTPS mirrors fail, the code walks DNS TXT records under *.dl.wel1.ru — first c.<domain> for a chunk count, then 0.<domain>, 1.<domain>,... — concatenating base64 fragments to reconstruct the executable payload out-of-band. The package's stated purpose is a trivial BoxyMakerLegacy class with no legitimate need for platform-specific native binaries, remote binary fetches, throwaway workers.dev hosts, disguised staging filenames, or DNS-TXT payload delivery. The behavior fires automatically on import, giving whoever published the package arbitrary code execution on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-maker-legacy"},"versions":["35.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"4bdb9175a880cc1daf9c8bd76a4654ee2307e2db745482e3b5b28fb8edcac606","tlsh":"bcb1b796027a70098bb0dbe5cb175416f66af6633780c588fb5ca9941f7602483f2efc"}],"package_integrity":[{"filename":"boxy-maker-legacy-35.1.7.tgz","hashes":{"sha1":"a2c12d9ce25651268c43ca2b56b9e54a190d8bae","sha512_sri":"sha512-eJ8Ir1zZOBi1TggAKOW5NIq4/2X80V30VYWG4yJ1y547piPIlzewzdEJzJdlod9dnSuOPR+2e4J5HF0/RwKPFA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-maker-legacy/v/35.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015322","import_time":"2026-08-05T15:19:44.78141784Z","modified_time":"2026-08-05T14:29:40Z","sha256":"fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b","source":"amazon-inspector","versions":["35.1.7"]}]}}