MAL-2026-13055 Malicious code in boxy-loader (npm)

On require('boxy-loader'), index.js loads adapter.js which executes setup() at module top level. setup() picks a platform-specific remote path, downloads an opaque executable from obfuscated Cloudflare Workers hosts (hostnames such as oob-worker.cf*.workers.dev are assembled at runtime by joining split string fragments), writes it to /var/tmp/.cache<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. If the HTTPS fetch fails, loadViaDns() falls back to resolveTxt('c.<domain>') to obtain a chunk count and then resolveTxt('<i>.<domain>') against *.dl.wel1.ru, base64-decodes the concatenated TXT records, writes the resulting bytes to disk and executes them — a DNS-tunneled payload channel designed to survive HTTPS egress filtering. Both the CDN host list and the DNS discovery domains are constructed from split string fragments to hide destinations from string-matching scans. The fetched executable is not shipped in the tarball, is not pinned or hash-verified, and is unrelated to any documented package purpose; the staging filename decoys (.cache_<hex>, dotnet_diag_<hex>.exe) further conceal it.