boxy-mmb-types

{"modified":"2026-08-05T14:26:54Z","published":"2026-08-05T14:26:54Z","schema_version":"1.7.4","id":"MAL-2026-13072","summary":"Malicious code in boxy-mmb-types (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80)\nindex.js unconditionally require()s _loader.js on module load. _loader.js reconstructs hostnames by joining split string fragments (evading static grep) to build endpoints under oob-worker.cf*.workers.dev with a DNS-TXT fallback via *.dl.wel1.ru, fetches a platform-specific native binary via https.get, writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c \"<path> &\" or cmd /c start. A TTL marker gates re-execution. A bundled lib/telemetry.js (~81 KB) is not imported by any code path and functions as decoy content to make the package resemble a legitimate telemetry wrapper. The obfuscated hostname assembly, disguised filenames, no-op stderr writer, and DNS covert-channel fallback are attacker anti-analysis patterns paired with the drop-and-execute chain.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-mmb-types"},"versions":["35.4.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"5eb88e5dc9fd1ce3f57c44727bee87075d38b7c95295b1489468ec5907d0ea9f","tlsh":"95b1b79a056570184bb09bf486274415f66ff6633380c298fb9ca5985f7712883b2efc"},{"path":"lib/telemetry.js","sha256":"ea2e9395ff01fec4c5269c71e695bf10658f4a640470be90396339d578ed9f08","tlsh":"43835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-mmb-types-35.4.1.tgz","hashes":{"sha1":"a174f803a34b1f2b677b267b217d146294de808d","sha512_sri":"sha512-ApluuI+H8KlStjoFlxfSi+xZEP+GBxE37h86puA0MOmlk0Z/5TKRESpojEs/3KBJWQ4/w4ynE3rcf0qqPN9W4A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-mmb-types/v/35.4.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015304","import_time":"2026-08-05T15:19:43.63377062Z","modified_time":"2026-08-05T14:26:54Z","sha256":"f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80","source":"amazon-inspector","versions":["35.4.1"]}]}}