What does the ded-pwa-c-boxy malware do?

On require() of the package, index.js loads _vendor.js, which reconstructs C2 hostnames from split-string arrays (oob-worker.cf102-baf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT covert-channel fallback), fetches a platform-specific opaque binary over HTTPS, writes it to /var/tmp or %TEMP% under names disguised as system caches (.cache_ / dotnet_diag_ .exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. The loader is invoked from index.js inside a try/catch that swallows all errors, gated on env variables DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and a filesystem TTL marker to evade repeated analysis. The package.json declares the packag

Which versions of ded-pwa-c-boxy are malicious?

The following npm versions of ded-pwa-c-boxy are flagged malicious: 35.9.1. Treat any of these as compromised.

How do I remediate ded-pwa-c-boxy if I installed it?

ded-pwa-c-boxy is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed ded-pwa-c-boxy — how do I know if it already compromised me?

If ded-pwa-c-boxy was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is ded-pwa-c-boxy part of a known attack campaign?

Yes — ded-pwa-c-boxy is associated with the IN-MAL-2026-017007 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ded-pwa-c-boxy across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for ded-pwa-c-boxy (version 35.9.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging ded-pwa-c-boxy across your stack and pipelines.

Malicious package

ded-pwa-c-boxynpm

ded-pwa-c-boxy is a confirmed malicious npm package (MAL-2026-13533) that steals credentials and exfiltrates sensitive data (malicious version 35.9.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ded-pwa-c-boxy (npm)

MAL-2026-13533

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall ded-pwa-c-boxy

What this malware does

On require() of the package, index.js loads vendor.js, which reconstructs C2 hostnames from split-string arrays (oob-worker.cf102-baf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT covert-channel fallback), fetches a platform-specific opaque binary over HTTPS, writes it to /var/tmp or %TEMP% under names disguised as system caches (.cache<hex> / dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. The loader is invoked from index.js inside a try/catch that swallows all errors, gated on env variables DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and a filesystem TTL marker to evade repeated analysis. The package.json declares the package as 'Reusable ded pwa c boxy components' with no dependencies and index.js exposes only a trivial DedPwaCBoxy class — the declared purpose is unrelated to any native-binary component. Destinations are anonymous Cloudflare Workers subdomains and a lookalike DNS namespace, not a publisher-owned or documented distribution host.

Malicious versions

1 flagged

35.9.1

Indicators of compromise (SHA-256)

b2293ad47611dcfbb22a3ef81df5e4f27dc942bd2bd2fc5865b60948dc6fc671

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for ded-pwa-c-boxy (version 35.9.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging ded-pwa-c-boxy across your stack and pipelines.
If you installed it — respond
ded-pwa-c-boxy is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If ded-pwa-c-boxy was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks ded-pwa-c-boxy before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. ded-pwa-c-boxy on npm has been identified as a malicious package (version 35.9.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017007

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks ded-pwa-c-boxy-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database