MAL-2026-13082 Malicious code in boxy-service (npm)

On require of the package, index.js unconditionally loads compat.js, which reconstructs attacker-controlled hostnames from split string arrays (oob-worker.cf10[0-3]-*.workers.dev and sdk.dl.wel1.ru), selects a per-OS endpoint, and downloads a platform-specific binary from paths such as /pkg/package, /pkg/loader_mac, and /pkg/package.exe. The binary is written to a hidden path (/tmp/.cache<rand> on Unix, %TEMP%/dotnet_diag_<rand>.exe on Windows under a.NET diagnostics cover name), chmod 0755'd on Unix, and detached-spawned via /bin/sh -c or cmd.exe /c start. A secondary covert channel resolves DNS TXT records for numbered subdomains under sdk.dl.wel1.ru, concatenates the responses, base64-decodes them, and treats the result as an executable payload. A second loader with the same shape is present in lib/telemetry.js under an 'Analytics SDK' cover story, using split identifiers such as require('child_'+'process') and fs['chmod'+'Sync'] to evade static inspection. The package uses hidden filenames, dot-prefixed paths, cover names imitating Microsoft diagnostics, string-array host reassembly, and DNS-TXT payload staging to conceal both the destinations and the behavior.