Malicious code in volna-boxy-di-test (npm)
The npm package volna-boxy-di-test contained malicious code that acts as a dropper, fetching and executing platform-specific payloads from attacker-controlled infrastructure on package require. The package masqueraded as a test harness while performing reconnaissance and payload delivery.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed and executed volna-boxy-di-test
- Ecosystems
- Attack vectors
- Affected entities
- volna-boxy-di-testnpm package containing malicious dropper code
The npm package volna-boxy-di-test contained malicious code embedded in index.js that loads a platform-specific payload module (_compat.js) on require. The dropper reconstructs command-and-control hostnames at runtime from fragmented strings, including variants of oob-worker.cf10*-*.workers.dev and a *.dl.well1.site DNS TXT record fallback mechanism.
The malicious code fetches unpinned, unhashed binary payloads over HTTPS and writes them to temporary directories (/tmp on Unix, %TEMP% on Windows) under disguised filenames such as .cache_ and dotnet_diag_.exe. On Unix systems, the files are made executable (chmod 0755) before being spawned detached via /bin/sh -c or cmd on Windows.
The dropper employs multiple evasion techniques: spoofing the User-Agent as node-fetch/2.6 to blend with legitimate traffic, using a TTL flag file (.analytics_state) to suppress re-execution, and gating execution behind environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK). Cover-story comments referencing "telemetry," "analytics," and "Skip in CI" mask the malicious intent.
The package presents itself as a test harness, but the fetched code, command-and-control infrastructure, and disguised filenames do not align with that stated purpose, indicating intentional deception.
Indicators of compromise
- Packages
- volna-boxy-di-test
- Domains
- oob-worker.cf10*-*.workers.dev
- *.dl.well1.site
Remediation
- Immediately uninstall volna-boxy-di-test from all systems
- Audit npm package.lock or yarn.lock files for any installations of volna-boxy-di-test
- Scan systems that executed this package for suspicious processes, network connections to oob-worker.cf10*-*.workers.dev or *.dl.well1.site, and files in /tmp or %TEMP% with names like .cache_ or dotnet_diag_.exe
- Review environment variables and system logs for evidence of payload execution
- Update npm dependencies and use npm audit to identify any other malicious packages
- Consider rotating credentials and reviewing system access logs if the package was executed in a development or CI/CD environment
Sources
- GitHub Advisory GHSA-m6vx-f9vm-7p7q · GitHub Advisory Database
Cite this entry
"Malicious code in volna-boxy-di-test (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-volna-boxy-di-test-npm-1eds5m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in a.poltoradnev-package-a
The npm package a.poltoradnev-package-a contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - activecritical
Malware in @zynkit/probe
Malware discovered in the npm package @zynkit/probe. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in bucket-protocol-sdk-v2
Malware discovered in the npm package bucket-protocol-sdk-v2. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in awesome-ts-jest
Malware was discovered in the npm package awesome-ts-jest. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package