Loading npm security reports…

boxy-add-link@35.7.5: Malicious npm security report (Block) | LPM Firewall

registry / boxy-add-link / 35.7.5

boxy-add-link@35.7.5

Boxy add link runtime support module

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package silently starts a payload bootstrapper. It retrieves an opaque platform binary, writes it to temporary storage, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Runtime import/require of boxy-add-link

Impact

Arbitrary native code execution under the importing process user.

Mechanism

remote binary download/DNS staging and detached execution

Attack narrative

Requiring the main entrypoint loads _compat.js, which immediately runs bootstrap(). It fetches an opaque platform-specific binary from rotating Workers hosts, with DNS TXT chunking as a fallback. If enough bytes are obtained, it writes the payload to a temporary file, makes it executable on Unix, and launches it via detached shell/cmd spawning. This is concealed as telemetry compatibility and has no user action or package function call requirement.

Rationale

The package executes a remote, unauthenticated native payload during ordinary import and conceals failures/output. This is concrete malware behavior, not normal telemetry.

Evidence

package.jsonindex.js_compat.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf102-baf.workers.dev/pkg/package

Source & flagged code

4 flagged · loading source

_compat.jsView file

2L3: const https = require("https"); L4: const path = require("path"); ... L42: const EXPIRE_SEC = 22395; L43: const _l = (...a) => process.stderr.write(""); L44: ... L54: const isWin = _p("platform") === "win32"; L55: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L56: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_compat.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js -> _compat.js L2: L3: const https = require("https"); L4: const path = require("path"); ... L42: const EXPIRE_SEC = 22395; L43: const _l = (...a) => process.stderr.write(""); L44: ... L54: const isWin = _p("platform") === "win32"; L55: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L56: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_compat.jsView on unpkg · L2

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_compat.jsView on unpkg · L120

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = twork-data-services-counterfree@20.1.3 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:20.1.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged

_compat.jsView file

2L3: const https = require("https"); L4: const path = require("path"); ... L42: const EXPIRE_SEC = 22395; L43: const _l = (...a) => process.stderr.write(""); L44: ... L54: const isWin = _p("platform") === "win32"; L55: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L56: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_compat.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> index.js -> _compat.js L2: L3: const https = require("https"); L4: const path = require("path"); ... L42: const EXPIRE_SEC = 22395; L43: const _l = (...a) => process.stderr.write(""); L44: ... L54: const isWin = _p("platform") === "win32"; L55: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L56: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L90: try { L91: require("dns").resolveTxt(d, (e, rr) => { L92: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_compat.jsView on unpkg · L2

120try { L121: const cp = require("child_process"); L122: if (isWin) {

High

Child Process

Package source references child process execution.

_compat.jsView on unpkg · L120

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = twork-data-services-counterfree@20.1.3 matchedPath = lib/telemetry.js matchedIdentity = npm:[redacted]:20.1.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg