boxy-test-block-fixture

{"modified":"2026-08-05T14:26:11Z","published":"2026-08-05T14:26:11Z","schema_version":"1.7.4","id":"MAL-2026-13089","summary":"Malicious code in boxy-test-block-fixture (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b10e5c9aa6fedcb9d29f292cd6f5aa6634e770f46c6385a9fb32c0fc628ab27a)\nOn require()/import of the package, _init.js assembles attacker-controlled hostnames at runtime by joining split string fragments (resolving to oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), fetches a platform-specific binary over HTTPS, and if that fails, falls back to a DNS-TXT covert channel that reassembles base64-encoded payload chunks from subdomains of dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under cover-story names such as 'dotnet_diag_*.exe' and '.cache_*', chmod 0755, and executed detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}).unref() (or the cmd equivalent on Windows). No signature or hash verification is performed. The destination hostnames are obfuscated via array-join splitting to evade static string scans, and the DNS-TXT fallback bypasses HTTPS egress filtering. Any project that installs and loads this package executes attacker-controlled native code on the host.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-test-block-fixture"},"versions":["35.5.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"4ece057c1433782c7d2d2cb4aa14d04e0b80ac25da7f7d151fed37ca331813c1","tlsh":"daa1756a066670194bb0dbe4c6175415f65af6636380d284fb9c699c1ff2128c2b3efc"}],"package_integrity":[{"filename":"boxy-test-block-fixture-35.5.5.tgz","hashes":{"sha1":"8b3c2ce20cc8bb30f2ff515cb90eb2fdb41ceb7c","sha512_sri":"sha512-b44dWfIjlpZd5D1nofiiTFCWtaePg/n+OIDKehp+PD9hMIqCIxuPTiG6CO5XFu30M6rgISkFacZMUJLJ8ola8A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-test-block-fixture/v/35.5.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015299","import_time":"2026-08-05T15:19:43.385480495Z","modified_time":"2026-08-05T14:26:11Z","sha256":"b10e5c9aa6fedcb9d29f292cd6f5aa6634e770f46c6385a9fb32c0fc628ab27a","source":"amazon-inspector","versions":["35.5.5"]}]}}