The ded-pwa-c-boxy npm package (version 35.9.1) includes a malicious loader in its index.js that fetches a platform-specific opaque binary from covert command-and-control (C2) hosts (oob-worker.cf102-baf.workers.dev and sdk.dl.wel1.ru) using HTTPS. It reconstructs these hostnames from split-string arrays and uses a DNS-TXT covert-channel fallback. The binary is saved to system temporary directories (/var/tmp or %TEMP%) under filenames disguised as system caches (.cache_<hex> or dotnet_diag_<hex>.exe), permissions are set to executable (0755), and it is spawned detached via shell commands. Execution is gated on environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a filesystem TTL marker to avoid repeated analysis. The package.json declares an unrelated purpose and no dependencies, and the external hosts are not publisher-owned or documented, indicating malicious intent.

This malicious package can execute arbitrary native code on the host system by downloading and running a concealed binary. This behavior can lead to unauthorized code execution, persistence, and potential compromise of the affected system. The use of covert channels and evasion techniques increases the difficulty of detection and analysis.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove ded-pwa-c-boxy version 35.9.1 from their environments and avoid installing it. Implement supply chain security measures such as verifying package integrity, using trusted package sources, and monitoring for suspicious package behavior. Since this is a malicious package, remediation involves removal and prevention rather than patching.