boxy-scroll-providers @35.5.1
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 11:52 AM UTC
OSV ID
MAL-2026-13079
Ecosystem
npm
Summary
On require() of boxy-scroll-providers, index.js loads _bootstrap.js which selects an OS-specific endpoint, downloads an opaque binary from obfuscated Cloudflare Workers hosts (oob-worker.cf10{0,1,2,3}-*.workers.dev, assembled at runtime by concatenating string fragments), writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. When HTTPS retrieval fails, _bootstrap.js falls back to a DNS TXT-record covert channel: it queries c.<domain> for a chunk count and then reassembles a base64-encoded payload from numbered subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A state file throttles re-execution across installs. Destination hostnames and file names are obfuscated to evade static inspection.
Source: amazon-inspector (c713e8e4ae3018f2614b7185c98b1f86dffcb684387e6a454d30a2c6eb8b89db)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.