boxy-loader@35.4.2: Malicious npm security report (Block)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers a remote payload loader. It downloads or DNS-reconstructs a binary, drops it in a temp directory, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Any Node process that requires/imports index.js.

Impact

Unconsented remote code execution with an attacker-controlled native payload.

Mechanism

import-time remote binary download, drop, and detached execution

Attack narrative

Requiring index.js silently loads _adapter.js. Its setup routine selects a platform payload path, tries rotating workers.dev hosts, then reconstructs a fallback payload from DNS TXT records. Once a payload exceeds 1000 bytes, it writes it to a temporary file, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. The behavior is not exposed as a user-invoked feature and is concealed behind telemetry-themed naming and a cooldown marker.

Rationale

The package performs concrete import-time staged payload delivery and detached execution, which is remote code execution rather than legitimate loader functionality.

Evidence

package.jsonindex.js_adapter.js/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints8

oob-worker.cf102-baf.workers.devoob-worker.cf101-adf.workers.dev

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _adapter.js at module load.
_adapter.js downloads platform binaries from rotating workers.dev hosts.
_adapter.js falls back to DNS TXT payload retrieval from wel1.ru domains.
Downloaded bytes are written to a temporary executable and launched detached via shell/cmd.
A hidden temp lock file throttles repeated execution.

Evidence against

package.json has no lifecycle scripts.
The public BoxyLoader API itself is minimal, but import-time adapter execution is unrelated to it.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.6 KB of source

Source & flagged code

3 flagged

_adapter.jsView file

3const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L46: const COOLDOWN = 20405; L47: const _l = (...a) => process.stderr.write(""); L48: ... L59: const isWin = _p("platform") === "win32"; L60: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L61: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_adapter.jsView on unpkg · L3

3Trigger-reachable chain: manifest.main -> index.js -> _adapter.js L3: const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L46: const COOLDOWN = 20405; L47: const _l = (...a) => process.stderr.write(""); L48: ... L59: const isWin = _p("platform") === "win32"; L60: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L61: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_adapter.jsView on unpkg · L3

121try { L122: const cp = require("child_process"); L123: if (isWin) {

High

Child Process

Package source references child process execution.

_adapter.jsView on unpkg · L121

Source & flagged code

3 flagged · loading source

_adapter.jsView file

3const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L46: const COOLDOWN = 20405; L47: const _l = (...a) => process.stderr.write(""); L48: ... L59: const isWin = _p("platform") === "win32"; L60: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L61: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_adapter.jsView on unpkg · L3

3Trigger-reachable chain: manifest.main -> index.js -> _adapter.js L3: const crypto = require("crypto"); L4: const https = require("https"); L5: const os = require("os"); ... L46: const COOLDOWN = 20405; L47: const _l = (...a) => process.stderr.write(""); L48: ... L59: const isWin = _p("platform") === "win32"; L60: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L61: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L93: try { L94: require("dns").resolveTxt(d, (e, rr) => { L95: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_adapter.jsView on unpkg · L3

Findings

2 Critical1 High2 Medium1 Low

CriticalDownload Execute_adapter.js

CriticalTrigger Reachable Dangerous Capability_adapter.js

HighChild Process_adapter.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem