MAL-2026-13034 Malicious code in boxy-contract (npm)

On require() of boxy-contract, index.js loads init.js which selects a platform-specific endpoint and downloads a binary over HTTPS from string-concatenated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev), with a DNS-TXT fallback under *.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under disguised names such as dotnet_diag<hex>.exe and.cache_<hex>, chmod'd to 0755, and spawned detached via spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd.exe /c start /b. Destination hostnames and dangerous API names (child_process, chmodSync) are assembled from fragmented literals joined at runtime to evade static analysis. A DISABLE_TELEMETRY environment gate and cover-story naming (.analytics_state marker, dotnet_diag_ filenames) present the behavior as diagnostics but do not represent user-consented telemetry. The dropped binary is an opaque, unpinned, unverified native executable from attacker-controlled infrastructure, granting arbitrary code execution on the installer's host on plain npm install / require.