Malicious code in ded-pwa-c-boxy-di (npm)

The npm package ded-pwa-c-boxy-di was found to contain malicious code in its index.js and loader.js files. Upon require(), the package automatically fetches a binary payload from attacker-controlled endpoints hosted on Cloudflare Workers (oob-worker.cf100-416.workers.dev and siblings) or via DNS-TXT fallback through sdk.dl.wel1.ru.\n\nThe malicious code constructs destination hostnames using array-join obfuscation to evade static analysis, downloads the binary payload over HTTPS without any signature verification or hash checking, and writes it to a temporary path under disguised names (e.g., dotnet_diag.exe, .cache_). The file is then made executable (chmod 0755) and spawned detached via /bin/sh -c or cmd.\n\nNo lifecycle hooks are required to trigger the malicious behavior—simply importing the package is sufficient. This represents a critical supply chain risk as any application or developer tool that depends on this package would automatically execute arbitrary code.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.