boxy-use-what-changed

{"modified":"2026-08-05T14:24:05Z","published":"2026-08-05T14:24:05Z","schema_version":"1.7.4","id":"MAL-2026-13095","summary":"Malicious code in boxy-use-what-changed (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667)\nOn require() of boxy-use-what-changed, index.js loads _ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT-record fallback under dl.wel1.ru (sdk.dl.wel1.ru, net.dl.wel1.ru). Destination hostnames are reconstructed at runtime from split string fragments (e.g. [\"oob-worker.cf\",\"100-416.worke\",\"rs.dev\"].join(\"\")) to evade static string matching. The fetched payload is written to a disguised path in /tmp or %TEMP% (.cache_<hex> or dotnet_diag_<hex>.exe), chmod 0o755, and executed detached via cp.spawn(\"/bin/sh\", [\"-c\", path+\" &\"], {detached:true}) or the Windows cmd equivalent. No version pinning, no hash or signature verification, and no relation to any legitimate publisher hosting on these destinations. A second file, lib/telemetry.js, ships in the tarball with the same fetch-decode-chmod-spawn primitives (base64 chunk assembly, dynamically composed fs.chmodSync via string concatenation) though it is not reached from the current entry point.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-use-what-changed"},"versions":["35.4.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"b2862b99483c5b2c503d76522ada7ae9d4259ad7d0f3555ea3e1f45c8281caf6","tlsh":"dfa1745a12a670084bb0a7e4c7074826f65bf6a33781d2d4fb5c65885f7762483b2efc"},{"path":"lib/telemetry.js","sha256":"69730d3c2c89eca01ef95426a17a58c69b2db7a41bc53d3e5a2c75932afd079d","tlsh":"93835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"boxy-use-what-changed-35.4.4.tgz","hashes":{"sha1":"e0a3bc81cf14b42ab0702fb4d29ed206d918f0b2","sha512_sri":"sha512-Ukx4YBRYa/kxMAfZBCgQxU1Vmc4I/RY68eMuu8Ka6T2CXlvFJh6JbD1lVpXHYmG1xh691oRMpwnF87giie2yww=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-use-what-changed/v/35.4.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015285","import_time":"2026-08-05T15:19:42.553839775Z","modified_time":"2026-08-05T14:24:05Z","sha256":"f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667","source":"amazon-inspector","versions":["35.4.4"]}]}}