Tool

box.js

Node.js utility for studying malicious JavaScript that runs a sample inside an emulated Windows JScript environment, with WScript, ActiveX, filesystem, registry, WMI and HTTP objects emulated and source rewriting that exposes eval calls and conditional-compilation code. Each analysis writes a results folder with the URLs requested and those that led to an executable payload, every code snippet executed (JavaScript, cmd.exe and PowerShell), files written with their types and hashes, and a list of IOCs; by default downloads are answered with simulated 404 errors so that fallback sites are revealed. Batch runs, an optional prepended file of browser-object stubs, a Docker image, a REST API and export to VirusTotal or Cuckoo support triage at scale.

Targets: Website
Category: Website analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-10-27

Requirements & limits

Latest npm release at review: 1.9.29, published 2026-07-02 alongside the reviewed master commit, which adapts the sandbox to the latest vm2 package; RELEASE_NOTES.txt numbers the same releases 1.19.x. Recent development is by Kirk Sayre through pull requests. Installs with npm install box-js --global; package.json declares Node.js 6 or later and depends on vm2 >=3.9.19, jsdom 16, acorn and escodegen, and the READMEs list REMnux and BlackArch packages and Cuckoo, CAPE and IntelOwl integrations.
Input is the analyst's own sample file or folder of samples; the repository ships no malware samples, only emulator code, a generated Windows process list (emulator/processes.json), source-rewriting patches and a mocha test file. Encoded .jse files must first be decoded with the bundled decoder.c, MrBrownstone's 2000–2005 Script Encoder decoder, compiled with a C compiler; VBScript is not parsed as input.
Samples run inside vm2, with a 10-second default timeout; --dangerous-vm switches to Node's vm module, which the README says can be broken. --download makes real requests to the URLs a sample contacts, so leave it off unless the network is isolated. The README recommends a temporary Docker container for further isolation; integrations/docker/Dockerfile is based on node:8-alpine, and the REST API server needs a user who can start Docker containers.
Emulation is incomplete by design: unsupported ActiveX objects or methods stop the analysis until someone implements them, and samples with environment or date checks may show no behaviour. MIT; decoder.c keeps its author's notice.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · CapacitorSet/box-js · Revision f4bb994
package.json GitHub · CapacitorSet/box-js · Revision f4bb994
RELEASE_NOTES.txt GitHub · CapacitorSet/box-js · Revision f4bb994
integrations/README.md GitHub · CapacitorSet/box-js · Revision f4bb994
integrations/docker/Dockerfile GitHub · CapacitorSet/box-js · Revision f4bb994
decoder.c GitHub · CapacitorSet/box-js · Revision f4bb994
emulator GitHub · CapacitorSet/box-js · Revision f4bb994
LICENSE GitHub · CapacitorSet/box-js · Revision f4bb994
https://www.npmjs.com/package/box-js/v/1.9.29

More in Websites

All 61 entries in Websites