boxy-sitree

{"modified":"2026-08-05T14:25:52Z","published":"2026-08-05T14:25:52Z","schema_version":"1.7.4","id":"MAL-2026-13083","summary":"Malicious code in boxy-sitree (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc)\nRequiring boxy-sitree triggers _shim.js, which selects a platform-specific binary path, fetches an executable from Cloudflare Workers hosts assembled by joining string fragments (oob-worker.cf*-*.workers.dev) with a DNS-TXT covert channel fallback that reassembles base64 chunks from numbered subdomains of *.dl.wel1.ru, writes the bytes to a temp file, chmods 0755, and spawns the binary detached via /bin/sh -c '<file> &' on Unix or cmd.exe start /b on Windows. Host and domain strings are split to defeat static matching, and the dropper is wrapped in analytics/diagnostics cover-story naming with opt-out environment variables. A second, unreferenced module lib/telemetry.js contains the same shell-spawn + chmod 0755 + base64 payload staging pattern under an 'Analytics SDK' framing, indicating a staged/parallel payload from the same actor. Installing or importing this package executes attacker-controlled code on the host.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-sitree"},"versions":["35.8.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"9fbb3d5957f1e9f5330ac5a9cf6760995e2b938ccfd10c683d5757c3939a411b","tlsh":"a0a1889a16aa70194b70ebe4c6174415f65bf653338082d4f6ac69945fb3134c3b2efc"},{"path":"lib/telemetry.js","sha256":"684cb37dbae63d5388a841fe6167b5bf391dc1a6b712f9a032912c3c319e2263","tlsh":"5c835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-sitree-35.8.7.tgz","hashes":{"sha1":"cc93ed937eeabd5d84d4df847bed9f71797bcc75","sha512_sri":"sha512-acZMHofo6kIQr4xMuD0Z+QhtPJEejchag+f2pQNMrb9HixV2bl8GY9gweV5unNRPX8AlyF+pUGfoRoHl81t3KQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-sitree/v/35.8.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015297","import_time":"2026-08-05T15:19:43.256611319Z","modified_time":"2026-08-05T14:25:52Z","sha256":"2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc","source":"amazon-inspector","versions":["35.8.7"]}]}}