boxy-wrapper-rspack-plugin

{"modified":"2026-08-05T14:22:49Z","published":"2026-08-05T14:22:49Z","schema_version":"1.7.4","id":"MAL-2026-13098","summary":"Malicious code in boxy-wrapper-rspack-plugin (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c)\nThe package advertises itself as an rspack plugin but ships a stub index.js that silently require()s _adapter.js, which runs at module load time. _adapter.js constructs Cloudflare Workers hostnames via string-array joins (e.g. 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf101-adf.workers.dev', 'oob-worker.cf99-9b3.workers.dev', 'oob-worker.cf102-baf.workers.dev'), downloads a platform-specific binary over HTTPS, writes it to a temp directory under a disguising filename (dotnet_diag_*.exe /.cache_*), chmods it 0o755, and spawns it detached via child_process. If the HTTPS fetch fails, loadViaDns() queries TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-reassembles the chunked TXT payload into an executable buffer, and executes it the same way. Environment flags such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK and a /tmp/.analytics_state cache file provide a telemetry-style cover story. The exported plugin class is a non-functional stub; the only effect of importing this package is the drop-and-execute of attacker-controlled code.\n","affected":[{"package":{"ecosystem":"npm","name":"boxy-wrapper-rspack-plugin"},"versions":["35.8.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"10da118ce2ae48b64914758afd00be8501c21d34a628e9808c6b2da39522b8fb","tlsh":"68b1a79606a670198bb0d7e4c717581af65bf6633780d2c4fa5ca9980f72124c3b2efc"},{"path":"index.js","sha256":"5225d402fcacff85b3c110fe036c5aa1295b757c59e7e907a72f2674b1b8a16a","tlsh":"9ff04c8550eeb42382b0a3fadb224082f5b685350e57925cbb9850ef0fa0814039ceba"}],"package_integrity":[{"filename":"boxy-wrapper-rspack-plugin-35.8.3.tgz","hashes":{"sha1":"88a995b645d95595235fc4f3df18dc0a8313a10b","sha512_sri":"sha512-1kPqMWGYWhm0qh2aDAlDbfA7mXLf7GAWALp5mw+NUpe5Qni1StsCjjIAaijEd6/l8kh6+1UbzyhrquEXobg2Qg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-wrapper-rspack-plugin/v/35.8.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015278","import_time":"2026-08-05T15:19:42.172055692Z","modified_time":"2026-08-05T14:22:49Z","sha256":"67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c","source":"amazon-inspector","versions":["35.8.3"]}]}}