Loading npm security reports…

boxy-page-story@35.8.5: Malicious npm security report (Block) | LPM Firewall

registry / boxy-page-story / 35.8.5

boxy-page-story@35.8.5

Boxy page story SDK for internal consumers

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an asynchronous remote payload download and execution chain. It fetches an OS-specific binary, writes it outside the project, and runs it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of index.js

Impact

Arbitrary code execution as the importing user.

Mechanism

remote binary download, drop, chmod, and detached execution

Attack narrative

The public entrypoint silently loads _runtime.js. On import, it selects a platform payload path, fetches bytes from rotating obfuscated hosts or DNS TXT records, writes the payload to a temporary executable path, marks it executable on Unix, and launches it detached through a shell or cmd.exe.

Rationale

This is a concrete import-time staged payload and execution chain unrelated to the package's minimal exported SDK. The lack of an install hook does not mitigate arbitrary code execution triggered by normal package use.

Evidence

package.jsonindex.js_runtime.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints8

oob-worker.cf100-416.workers.dev/pkg/packageoob-worker.cf102-baf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package

Source & flagged code

4 flagged · loading source

_runtime.jsView file

5const os = require("os"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L45: const CACHE_TTL = 22022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L56: const isWin = _p("platform") === "win32"; L57: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L58: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L87: try { L88: require("dns").resolveTxt(d, (e, rr) => { L89: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_runtime.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _runtime.js L5: const os = require("os"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L45: const CACHE_TTL = 22022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L56: const isWin = _p("platform") === "win32"; L57: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L58: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L87: try { L88: require("dns").resolveTxt(d, (e, rr) => { L89: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_runtime.jsView on unpkg · L5

116try { L117: const cp = require("child_process"); L118: if (isWin) {

High

Child Process

Package source references child process execution.

_runtime.jsView on unpkg · L116

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = boxy-constants@35.2.7 matchedPath = lib/telemetry.js matchedIdentity = npm:Ym94eS1jb25zdGFudHM:35.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Source & flagged code

4 flagged

_runtime.jsView file

5const os = require("os"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L45: const CACHE_TTL = 22022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L56: const isWin = _p("platform") === "win32"; L57: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L58: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L87: try { L88: require("dns").resolveTxt(d, (e, rr) => { L89: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_runtime.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> index.js -> _runtime.js L5: const os = require("os"); L6: const https = require("https"); L7: const crypto = require("crypto"); ... L45: const CACHE_TTL = 22022; L46: const _l = (...a) => process.stderr.write(""); L47: ... L56: const isWin = _p("platform") === "win32"; L57: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L58: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L87: try { L88: require("dns").resolveTxt(d, (e, rr) => { L89: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_runtime.jsView on unpkg · L5

116try { L117: const cp = require("child_process"); L118: if (isWin) {

High

Child Process

Package source references child process execution.

_runtime.jsView on unpkg · L116

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = boxy-constants@35.2.7 matchedPath = lib/telemetry.js matchedIdentity = npm:Ym94eS1jb25zdGFudHM:35.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg