{"answers":{"affected":"1 open source package ship an affected version, including boxy-maker-bus.","exploited":"There is no known exploitation of MAL-2026-13058 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13058 is a malicious package in boxy-maker-bus, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-13058 is a malicious package: boxy-maker-bus (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13058/ (Markdown: https://insights.sbomify.com/MAL-2026-13058/index.md)","id":"MAL-2026-13058","markdown":"https://insights.sbomify.com/MAL-2026-13058/index.md","name":"MAL-2026-13058","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"boxy-maker-bus@35.7.7 acts as a load-time dropper. The package's index.js unconditionally requires _compat.js on load, which assembles Cloudflare Workers hostnames (oob-worker.cf99-9b3/cf100-416/cf101-adf.workers.dev) and a wel1.ru-based DNS covert channel from split string fragments, downloads a platform-specific opaque binary over HTTPS with no hash or signature verification, writes it to a disguised path (dotnet_diag_\u003ctoken\u003e.exe on Windows,.cache_\u003ctoken\u003e on POSIX) under /tmp or %TEMP%, chmods 0755, and spawns it detached via cmd.exe /c start /b or /bin/sh -c. A secondary delivery path enumerates DNS TXT records at c.\u003cdomain\u003e and \u003ci\u003e.\u003cdomain\u003e, concatenates the chunks, and base64-decodes them into the executable payload. The dropper is wrapped in cover-story naming (analytics_state stamp file, DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK env gates, an unused lib/telemetry.js labeled 'Analytics SDK', dotnet_diag filename) that does not correspond to the package's stated 'runtime support module' purpose. The delivered bytes are attacker-controlled and unverified, giving whoever controls the workers.dev and wel1.ru infrastructure arbitrary code execution on any host that installs or imports the package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in boxy-maker-bus (npm)","id":"MAL-2026-13058","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"boxy-maker-bus","purl":"pkg:npm/boxy-maker-bus","source":"MAL-2026-13058"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13058/"}