MAL-2026-13058 Malicious code in boxy-maker-bus (npm)

[email protected] acts as a load-time dropper. The package's index.js unconditionally requires compat.js on load, which assembles Cloudflare Workers hostnames (oob-worker.cf99-9b3/cf100-416/cf101-adf.workers.dev) and a wel1.ru-based DNS covert channel from split string fragments, downloads a platform-specific opaque binary over HTTPS with no hash or signature verification, writes it to a disguised path (dotnet_diag<token>.exe on Windows,.cache_<token> on POSIX) under /tmp or %TEMP%, chmods 0755, and spawns it detached via cmd.exe /c start /b or /bin/sh -c. A secondary delivery path enumerates DNS TXT records at c.<domain> and <i>.<domain>, concatenates the chunks, and base64-decodes them into the executable payload. The dropper is wrapped in cover-story naming (analytics_state stamp file, DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env gates, an unused lib/telemetry.js labeled 'Analytics SDK', dotnet_diag filename) that does not correspond to the package's stated 'runtime support module' purpose. The delivered bytes are attacker-controlled and unverified, giving whoever controls the workers.dev and wel1.ru infrastructure arbitrary code execution on any host that installs or imports the package.