boxy-rspack-optimize-sharing-runtime

{"modified":"2026-08-05T14:25:44Z","published":"2026-08-05T14:25:44Z","schema_version":"1.7.4","id":"MAL-2026-13078","summary":"Malicious code in boxy-rspack-optimize-sharing-runtime (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80)\nThe package's index.js unconditionally requires./_bridge on module load. _bridge.js selects a platform-specific payload path (linux_x64, linux_arm64, darwin, win32.exe), downloads bytes from a rotating list of *.workers.dev hosts whose hostnames are reconstructed by array-joining string fragments (e.g. ['oob-worker.cf100','-416.worke','rs','.de','v'].join('')), with a DNS-TXT fallback that reassembles a base64 payload from chunked TXT records under *.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /var/tmp/.cache_<hex> or %TEMP%\\dotnet_diag_<hex>.exe, chmod 0755, then spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A second file lib/telemetry.js ships the same drop-and-exec primitives (base64 chunk reassembly, string-concatenated fs['chmod'+'Sync'], /bin/sh spawn) framed as an APM SDK, though it is not on the reachable graph from index.js. Filenames such as.cache_/.analytics_state/dotnet_diag_ and a DISABLE_TELEMETRY env check are cover framing; the endpoint reconstruction and DNS-TXT smuggling are not legitimate telemetry patterns. Any require/import of this package results in remote code execution on the host.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-rspack-optimize-sharing-runtime"},"versions":["35.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"baddb8a431544bab5d75cfe180548e661f843fb3dc6fb388b87a5a6bec7df92b","tlsh":"6aa1969a0266701987b0d7e4c71b5416fa5be6633380c2d4fb5c99985f731648372efc"},{"path":"lib/telemetry.js","sha256":"6fdb87dc50f635a374257fbe89b45e3ac0bacbe2fb46391c348ecc3701c60bb2","tlsh":"01835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-rspack-optimize-sharing-runtime-35.2.9.tgz","hashes":{"sha1":"e10a695655b00f041b5afb20014430e0229db6b8","sha512_sri":"sha512-oHlHXDZy8xcedxuV/0iv8LwbS/l4bnb6OqtpjGHh+9GmcDARpPCKEJdZr+BF8UlFF0efqhMufiaSPeI1VEZXwQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-rspack-optimize-sharing-runtime/v/35.2.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015296","import_time":"2026-08-05T15:19:43.200138471Z","modified_time":"2026-08-05T14:25:44Z","sha256":"be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80","source":"amazon-inspector","versions":["35.2.9"]}]}}