ded-pwa-c-boxy-di

{"modified":"2026-08-07T12:31:52Z","published":"2026-08-07T12:31:52Z","schema_version":"1.7.4","id":"MAL-2026-13534","summary":"Malicious code in ded-pwa-c-boxy-di (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037)\nOn require('ded-pwa-c-boxy-di'), index.js loads _loader.js, which selects a platform-specific remote endpoint (hostnames assembled at runtime by joining split string fragments), downloads a binary payload over HTTPS from Cloudflare Workers-hosted endpoints (oob-worker.cf100-416.workers.dev and siblings) with a DNS-TXT base64 fallback channel via sdk.dl.wel1.ru, writes the bytes to a temporary path under a disguised name (e.g. dotnet_diag_*.exe,.cache_*), chmods the file to 0755, and spawns it detached via /bin/sh -c or cmd. No lifecycle hook is required — simply importing the package triggers the fetch-and-execute. Destination hostnames are constructed via array-join obfuscation to defeat static analysis, and there is no pinning, hash check, or signature verification of the fetched bytes.\n","affected":[{"package":{"ecosystem":"npm","name":"ded-pwa-c-boxy-di"},"versions":["35.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"410a6d5754082af62d86be897632a5e402e84f17b2894ea9c6e3c17bcf6b3d6f","tlsh":"8ba1b75612a670184bb0dbe4cb174816f65bf6633781c288f75ca5885f7352883b2efc"}],"package_integrity":[{"filename":"ded-pwa-c-boxy-di-35.2.2.tgz","hashes":{"sha1":"9aa9663c57dc91fc34f6e62fccbd1ee24615301d","sha512_sri":"sha512-Rdz7+AjKavvXQZxNz+QDxnVkHPSqiC1tx1bvEFZ78Or950whsOFgItW2aRKnfKYXMdsMRXNLbyDq3iANT85Aqg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ded-pwa-c-boxy-di/v/35.2.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017018","import_time":"2026-08-07T12:51:22.398045512Z","modified_time":"2026-08-07T12:31:52Z","sha256":"eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037","source":"amazon-inspector","versions":["35.2.2"]}]}}