boxy-maker-sticky @35.9.7

Summary

On require() of boxy-maker-sticky, index.js loads _runtime.js which reconstructs C2 hostnames from split string fragments ("oob-worker.cf103-0"+"70.worke"+"rs.dev" and "sdk.dl.we"+"l1.ru"), performs an https.get against those hosts to download a platform-specific binary, writes it to a temp directory under a disguised filename (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on POSIX), chmods it 0755, and spawns it detached via cmd.exe or /bin/sh -c with.unref(). A DNS-TXT chunked fallback path resolves further payload data through *.dl.wel1.ru. A.analytics_state file is written as a persistence/timestamp marker. The fetched content is unpinned, unverified, and unrelated to any stated package purpose; hostname obfuscation via runtime string joining is deliberate evasion. The behavior fires automatically on module load, giving whoever controls the origin hosts arbitrary code execution on the installer's machine.

Source: amazon-inspector (dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0)