MAL-2026-13093 Malicious code in boxy-tree-providers (npm)
Malicious package
Published
MAL-2026-13093 is a malicious package: boxy-tree-providers (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13093/ (Markdown: https://insights.sbomify.com/MAL-2026-13093/index.md)
- Package
- boxy-tree-providers
- Registry
- npm
What is MAL-2026-13093?
MAL-2026-13093 is a malicious package in boxy-tree-providers, published on 5 Aug 2026.
Official description
On any require()/import of the package, index.js loads ext.js which reconstructs four Cloudflare Workers destinations (oob-worker.cf*.workers.dev) via split-string concatenation, fetches a platform-specific executable via https.get, writes it to /tmp or %TEMP% under masquerade names such as dotnet_diag.exe and.cache_, chmods it 0755, and spawns it detached via spawn('/bin/sh',…) or spawn('cmd',…). If HTTPS retrieval fails, a DNS-TXT loader (loadViaDns) reassembles a base64-encoded payload from TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. No integrity or signature check is performed. lib/telemetry.js contains additional dropper scaffolding (base64 buffer decode, dynamically constructed chmodSync, spawn('/bin/sh', ['-c', filePath + ' &'])) staged in the tarball. Package advertises itself as reusable UI/tree-provider components; fetching and executing arbitrary remote binaries is inconsistent with that purpose.
What should I do about MAL-2026-13093?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.