Malicious code in volna-boxy-di-test (npm)
The npm package volna-boxy-di-test contained malicious code that acts as a dropper, fetching and executing platform-specific payloads from attacker-controlled infrastructure on package require. The package masqueraded as a test harness while performing reconnaissance and payload delivery.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed and executed volna-boxy-di-test
- Ecosystems
- Attack vectors
- Affected entities
- volna-boxy-di-testnpm package containing malicious dropper code
The npm package volna-boxy-di-test contained malicious code embedded in index.js that loads a platform-specific payload module (_compat.js) on require. The dropper reconstructs command-and-control hostnames at runtime from fragmented strings, including variants of oob-worker.cf10*-*.workers.dev and a *.dl.well1.site DNS TXT record fallback mechanism.
The malicious code fetches unpinned, unhashed binary payloads over HTTPS and writes them to temporary directories (/tmp on Unix, %TEMP% on Windows) under disguised filenames such as .cache_ and dotnet_diag_.exe. On Unix systems, the files are made executable (chmod 0755) before being spawned detached via /bin/sh -c or cmd on Windows.
The dropper employs multiple evasion techniques: spoofing the User-Agent as node-fetch/2.6 to blend with legitimate traffic, using a TTL flag file (.analytics_state) to suppress re-execution, and gating execution behind environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK). Cover-story comments referencing "telemetry," "analytics," and "Skip in CI" mask the malicious intent.
The package presents itself as a test harness, but the fetched code, command-and-control infrastructure, and disguised filenames do not align with that stated purpose, indicating intentional deception.
Indicators of compromise
- Packages
- volna-boxy-di-test
- Domains
- oob-worker.cf10*-*.workers.dev
- *.dl.well1.site
Remediation
- Immediately uninstall volna-boxy-di-test from all systems
- Audit npm package.lock or yarn.lock files for any installations of volna-boxy-di-test
- Scan systems that executed this package for suspicious processes, network connections to oob-worker.cf10*-*.workers.dev or *.dl.well1.site, and files in /tmp or %TEMP% with names like .cache_ or dotnet_diag_.exe
- Review environment variables and system logs for evidence of payload execution
- Update npm dependencies and use npm audit to identify any other malicious packages
- Consider rotating credentials and reviewing system access logs if the package was executed in a development or CI/CD environment
Sources
- GitHub Advisory GHSA-m6vx-f9vm-7p7q · GitHub Advisory Database
Cite this entry
"Malicious code in volna-boxy-di-test (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-volna-boxy-di-test-npm-1eds5m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package