dolyame-boxy-markdown

{"modified":"2026-08-05T15:21:15Z","published":"2026-08-05T15:21:15Z","schema_version":"1.7.4","id":"MAL-2026-13336","summary":"Malicious code in dolyame-boxy-markdown (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6)\nOn require() of dolyame-boxy-markdown, index.js loads _ext.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT covert-channel fallback under *.dl.wel1.ru (sdk/ext/pkg/net subdomains). The fetched bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755, then spawned detached via cmd.exe /c start /b on Windows or /bin/sh -c '<path> &' on Unix. No hash or signature verification is performed. Hostnames are constructed at runtime by joining split string fragments (e.g. ['oob-w','orker.cf101-adf.w','orkers.de','v'].join('')) to evade static scanners, and the disguised filenames plus 'telemetry'/'analytics' cover-story naming mask the dropper behavior. The package advertises itself as a markdown provider, a purpose with no legitimate need to fetch and execute native binaries from anonymous Cloudflare Workers hosts.\n","affected":[{"package":{"ecosystem":"npm","name":"dolyame-boxy-markdown"},"versions":["35.9.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_ext.js","sha256":"6349fd14c4120b8eada80758cd43bd0b2d86829ea8b5a03608a919295acce751","tlsh":"69a1755a127a70198bb0a7f4871b441af65bf6633380c294fb6c64985f7752483b2dfc"}],"package_integrity":[{"filename":"dolyame-boxy-markdown-35.9.4.tgz","hashes":{"sha1":"4237e45a8e97d48b1949a020776090df4be03c43","sha512_sri":"sha512-qRkjI/yNpW2VMnIVX7msgcJfKlyVNVNLJncwgyAH7Gvp1FJcUJxw1UMcgUm22xyB4zcQgiWsEN3Qa/bfEP0Dvw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-markdown/v/35.9.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015665","import_time":"2026-08-05T16:13:29.82592601Z","modified_time":"2026-08-05T15:21:15Z","sha256":"373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6","source":"amazon-inspector","versions":["35.9.4"]}]}}