{"answers":{"affected":"1 open source package ship an affected version, including boxy-debugger.","exploited":"There is no known exploitation of MAL-2026-13036 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13036 is a malicious package in boxy-debugger, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-13036 is a malicious package: boxy-debugger (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13036/ (Markdown: https://insights.sbomify.com/MAL-2026-13036/index.md)","id":"MAL-2026-13036","markdown":"https://insights.sbomify.com/MAL-2026-13036/index.md","name":"MAL-2026-13036","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers _platform.js, which reconstructs attacker-controlled destinations from split string arrays (hosts under oob-worker.cf*.workers.dev and *.dl.wel1.ru), downloads a platform-specific native binary via https.get, writes it to /tmp or %TEMP% under cover-story names such as.cache_\u003chex\u003e and dotnet_diag_\u003chex\u003e.exe, chmods it to 0755, and spawns it detached through /bin/sh -c or cmd.exe /c start. A DNS-TXT chunked-base64 channel over *.dl.wel1.ru serves as a fallback delivery path, and a sibling module lib/telemetry.js carries parallel dropper logic (base64 payload assembly, spawn of /bin/sh -c, chmod 0755 via string-concatenated \"chmod\"+\"Sync\") staged as latent payload. Destinations are unpinned, unsigned, and obfuscated; the framing as telemetry/analytics does not match the actual behavior, which is full-host remote code execution against every environment that installs or imports the package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in boxy-debugger (npm)","id":"MAL-2026-13036","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"boxy-debugger","purl":"pkg:npm/boxy-debugger","source":"MAL-2026-13036"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13036/"}