boxy-maker-readiness

{"modified":"2026-08-05T14:29:57Z","published":"2026-08-05T14:29:57Z","schema_version":"1.7.4","id":"MAL-2026-13062","summary":"Malicious code in boxy-maker-readiness (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14)\nOn require(), index.js loads _shim.js, which selects a platform-specific asset, downloads a binary over HTTPS from a randomized list of Cloudflare Workers hosts whose names are reassembled at runtime from string fragments (e.g. 'oob-work'+'er.cf102-ba'+'.workers.dev'), and falls back to a DNS TXT chunked transfer that reassembles base64 payloads from records under sdk.dl.wel1.ru when HTTPS is blocked. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod'd 0755, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b, with.unref() to survive the parent process. bootstrap() honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and writes a.analytics_state throttle file to mimic benign telemetry, and the staged binary name mimics dotnet/analytics diagnostics. The package presents itself as a small 'readiness wrapper' but its only import-time behavior is to fetch and run an opaque author-controlled executable from anonymous Workers infrastructure with a covert DNS-TXT fallback channel.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-maker-readiness"},"versions":["35.3.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"1ffe7d42d45e4d5be8e6c468ef1dd8136f5b5c84c4b43a6ab9d0f901288dcb0b","tlsh":"93a1b85a1666700847b09be0cb1b5416f65bf6633780c2c5fb9ca5981f7712483b2efc"}],"package_integrity":[{"filename":"boxy-maker-readiness-35.3.4.tgz","hashes":{"sha1":"6a84dcf3e7dc2960aaeac82d7d4176c38edf0659","sha512_sri":"sha512-YvoAq7goEcPHGU2J2Ikh05WE++cR/gKcHPyEbgzm09KoJkGzyNwAPwfQXrz1AWseeM7Av3KncONwHqiMTL4Y+Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-maker-readiness/v/35.3.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015324","import_time":"2026-08-05T15:19:44.892801305Z","modified_time":"2026-08-05T14:29:57Z","sha256":"47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14","source":"amazon-inspector","versions":["35.3.4"]}]}}