boxy-temper @35.1.5

Summary

index.js require()s _bridge.js on module load. _bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are assembled at runtime via Array.join('') (e.g. 'oob-worker.cf103-070.workers.dev', 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf99-9b3.workers.dev'), downloads an opaque binary over HTTPS, writes it to /tmp on unix or %TEMP% on windows under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached with stdio ignored via cp.spawn('/bin/sh', ['-c', fp+' &']) or the cmd equivalent. If the HTTPS fetch fails, the code falls back to a DNS-TXT covert channel, issuing chunked TXT queries to attacker-controlled subdomains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), base64-reassembles the responses into a binary, writes it to disk and executes it. Hostnames are split into fragments and joined at runtime specifically to evade static string matching, and opt-out env vars are labeled as 'analytics' as a cover story. The package's advertised purpose is a 'boxy temper microservice adapter' but the main class is a no-op stub; the only real behavior is the loader. No hash or signature verification is performed on the downloaded payload.

Source: amazon-inspector (b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2)