boxy-tree-providers

{"modified":"2026-08-05T14:24:43Z","published":"2026-08-05T14:24:43Z","schema_version":"1.7.4","id":"MAL-2026-13093","summary":"Malicious code in boxy-tree-providers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5)\nOn any require()/import of the package, index.js loads _ext.js which reconstructs four Cloudflare Workers destinations (oob-worker.cf*.workers.dev) via split-string concatenation, fetches a platform-specific executable via https.get, writes it to /tmp or %TEMP% under masquerade names such as dotnet_diag_*.exe and.cache_*, chmods it 0755, and spawns it detached via spawn('/bin/sh',...) or spawn('cmd',...). If HTTPS retrieval fails, a DNS-TXT loader (loadViaDns) reassembles a base64-encoded payload from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. No integrity or signature check is performed. lib/telemetry.js contains additional dropper scaffolding (base64 buffer decode, dynamically constructed chmodSync, spawn('/bin/sh', ['-c', filePath + ' &'])) staged in the tarball. Package advertises itself as reusable UI/tree-provider components; fetching and executing arbitrary remote binaries is inconsistent with that purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-tree-providers"},"versions":["35.3.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"926b128df2a5638a29ea4b1f9cea5f848bbbf51b832cfa75cf82f39a42df7074","tlsh":"06a1966a1666701887b0d7e8c7175416f65bf76337c0c284fb9ca9981f7212882b2efc"},{"path":"lib/telemetry.js","sha256":"22a33e80fc247a7e22f524b321fb2d658c91c06feb9ce9d1e002072855ff1163","tlsh":"a3835055566a242186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-tree-providers-35.3.9.tgz","hashes":{"sha1":"d8435d5008e7bc0713625fb9c3b6a3dbb37a6e01","sha512_sri":"sha512-rn/+VJMbj4UhU8e8tOfNeDCT3rv6oqgkBM1fy56QIyqFxEwRmQ7TWmr5uMPuDKVbZxWW5LySvfdauBNX1FrZfg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-tree-providers/v/35.3.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015289","import_time":"2026-08-05T15:19:42.787210319Z","modified_time":"2026-08-05T14:24:43Z","sha256":"98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5","source":"amazon-inspector","versions":["35.3.9"]}]}}