Malicious code in ded-pwa-c-boxy (npm)

The npm package ded-pwa-c-boxy was found to contain malicious code in its index.js entry point. Upon require(), the package loads _vendor.js, which reconstructs command-and-control hostnames from split-string arrays pointing to oob-worker.cf102-baf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT covert-channel fallback mechanism.

The malicious loader fetches a platform-specific opaque binary over HTTPS and writes it to temporary directories (/var/tmp on Unix or %TEMP% on Windows) under names disguised as system caches (.cache_ or dotnet_diag_.exe). The binary is then made executable (chmod 0755) and spawned as a detached process via /bin/sh -c on Unix or cmd.exe /c start /b on Windows.

The loader is wrapped in a try/catch block that silently swallows all errors and is gated on environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a filesystem TTL marker to evade repeated analysis. The package.json declares the package as 'Reusable ded pwa c boxy components' with no dependencies, and index.js exposes only a trivial DedPwaCBoxy class—the declared purpose bears no relation to native-binary execution.

The C2 infrastructure uses anonymous Cloudflare Workers subdomains and lookalike DNS namespaces rather than publisher-owned or documented distribution hosts, indicating intentional obfuscation.