{"schema_version":"1.8.0","id":"MAL-2026-13061","published":"2026-08-05T14:30:54Z","modified":"2026-08-05T15:52:03.505769220Z","summary":"Malicious code in boxy-maker-page-readiness (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed)\nindex.js unconditionally requires _bootstrap.js on module load. _bootstrap.js reassembles hostnames from split-string arrays (e.g. ['oo','b-worker.cf101-adf.worke','rs.','de','v'].join('') and ['sdk.dl.','we','l1.','ru'].join('')) to resolve to *.workers.dev and *.dl.wel1.ru endpoints. It selects a platform-specific payload path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), fetches the binary over HTTPS, writes it to a temp path under decoy names (dotnet_diag_*.exe,.cache_*,.analytics_state), chmods 0755, and spawns it detached via spawn(\"/bin/sh\") or spawn(\"cmd\"). A base64-over-DNS-TXT fallback channel (resolveTxt of c.<domain> and <i>.<domain> reassembled and base64-decoded) provides an alternate retrieval path when HTTPS fetch fails. The fetched executable is unpinned and unverified, obtained from hosts unrelated to the package's stated readiness-interface purpose.\n","affected":[{"package":{"name":"boxy-maker-page-readiness","ecosystem":"npm","purl":"pkg:npm/boxy-maker-page-readiness"},"versions":["35.7.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"91dde98fe2be332b0788d4e11ae3f6b6d7f1c4583569808d034cdfc5ee160c54","tlsh":"60a1b89a126670088bb0dbe4872b5415f55ef1633781c294f7aca4985fb712483b1efc"}],"package_integrity":[{"filename":"boxy-maker-page-readiness-35.7.8.tgz","hashes":{"sha1":"0a7fb94d567e2d2181a3b3a3ac8ea3a3d078691a","sha512_sri":"sha512-UZ+KTMGv4kosaBjTwou5JWRSF+XMQwiLXfKMN70POTSdE4IYiItIdDtv20U4os0e/kQthUpLDDtRjJ3olqLHwA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-maker-page-readiness/MAL-2026-13061.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-maker-page-readiness/v/35.7.8"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015330","import_time":"2026-08-05T15:19:45.268916991Z","modified_time":"2026-08-05T14:30:54Z","sha256":"273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed","source":"amazon-inspector","versions":["35.7.8"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}