{"schema_version":"1.8.0","id":"MAL-2026-13074","published":"2026-08-05T14:27:29Z","modified":"2026-08-05T15:52:10.381718073Z","summary":"Malicious code in boxy-page-story (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6cb3184221c24b500fca09d9e96c886b1ffe703d60b121150180b2387a87c48d)\nOn require, index.js loads./_runtime, which reconstructs C2 hostnames from string-array concatenation to hide four oob-worker.cf1{00,01,02,03}-*.workers.dev endpoints and a wel1.ru DNS-TXT covert-channel fallback (chunk-count TXT at c.<domain>, base64 chunks at <n>.<domain>, reassembled and base64-decoded). A platform-specific binary is downloaded, written to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and spawned detached via /bin/sh -c \"<path> &\" or cmd.exe /c start /b. No hash or signature verification; hosts are attacker-controlled non-publisher infrastructure. Fetch is gated by absence of a recent cache file and DO_NOT_TRACK-style env vars. index.js wraps the require in try/catch to swallow errors silently.\n","affected":[{"package":{"name":"boxy-page-story","ecosystem":"npm","purl":"pkg:npm/boxy-page-story"},"versions":["35.8.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"964ae178ebd7a6b7b75f6f865867a51353ab6b523832e0e28d050703a300756c","tlsh":"45a16396166a710887b097e4c71b4416f55bf6a333c0d2d4fbaca5981fb312482b2efc"}],"package_integrity":[{"filename":"boxy-page-story-35.8.5.tgz","hashes":{"sha1":"f8d34e329e8b9de134f88ee69987bd8b35c37c80","sha512_sri":"sha512-n1bgnE4mF82NU6DhD/xeZu/NadqPU2IDr8xDHtdKpfZM/7+aJP72iqRMpjU6TNG9mbSaKhZipPzpp7T9HNX25Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/boxy-page-story/MAL-2026-13074.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/boxy-page-story/v/35.8.5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015308","import_time":"2026-08-05T15:19:43.947838707Z","modified_time":"2026-08-05T14:27:29Z","sha256":"6cb3184221c24b500fca09d9e96c886b1ffe703d60b121150180b2387a87c48d","source":"amazon-inspector","versions":["35.8.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}