# box.js

> Node.js utility for studying malicious JavaScript that runs a sample inside an emulated Windows JScript environment, with WScript, ActiveX, filesystem, registry, WMI and HTTP objects emulated and source rewriting that exposes eval calls and conditional-compilation code. Each analysis writes a results folder with the URLs requested and those that led to an executable payload, every code snippet executed (JavaScript, cmd.exe and PowerShell), files written with their types and hashes, and a list of IOCs; by default downloads are answered with simulated 404 errors so that fallback sites are revealed. Batch runs, an optional prepended file of browser-object stubs, a Docker image, a REST API and export to VirusTotal or Cuckoo support triage at scale.

- Type: Tool
- Targets: Website
- Category: Website analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-04
- Original resource: <https://github.com/CapacitorSet/box-js>
- Primary source: <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/README.md>
- Catalog page: <https://awesomerea.org/resources/box-js/>
- Record JSON: <https://awesomerea.org/resources/box-js/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/box-js/index.md)

## Requirements & limits

- Latest npm release at review: 1.9.29, published 2026-07-02 alongside the reviewed master commit, which adapts the sandbox to the latest vm2 package; RELEASE_NOTES.txt numbers the same releases 1.19.x. Recent development is by Kirk Sayre through pull requests. Installs with npm install box-js --global; package.json declares Node.js 6 or later and depends on vm2 >=3.9.19, jsdom 16, acorn and escodegen, and the READMEs list REMnux and BlackArch packages and Cuckoo, CAPE and IntelOwl integrations.
- Input is the analyst's own sample file or folder of samples; the repository ships no malware samples, only emulator code, a generated Windows process list (emulator/processes.json), source-rewriting patches and a mocha test file. Encoded .jse files must first be decoded with the bundled decoder.c, MrBrownstone's 2000–2005 Script Encoder decoder, compiled with a C compiler; VBScript is not parsed as input.
- Samples run inside vm2, with a 10-second default timeout; --dangerous-vm switches to Node's vm module, which the README says can be broken. --download makes real requests to the URLs a sample contacts, so leave it off unless the network is isolated. The README recommends a temporary Docker container for further isolation; integrations/docker/Dockerfile is based on node:8-alpine, and the REST API server needs a user who can start Docker containers.
- Emulation is incomplete by design: unsupported ActiveX objects or methods stop the analysis until someone implements them, and samples with environment or date checks may show no behaviour. MIT; decoder.c keeps its author's notice.

## Primary sources

1. <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/README.md>
2. <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/package.json>
3. <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/RELEASE_NOTES.txt>
4. <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/integrations/README.md>
5. <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/integrations/docker/Dockerfile>
6. <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/decoder.c>
7. <https://github.com/CapacitorSet/box-js/tree/f4bb9942f73e1b6eede149103fa074e0d408a6a7/emulator>
8. <https://github.com/CapacitorSet/box-js/blob/f4bb9942f73e1b6eede149103fa074e0d408a6a7/LICENSE>
9. <https://www.npmjs.com/package/box-js/v/1.9.29>

## More in Websites

- [breakinggood](https://awesomerea.org/resources/breakinggood/index.md) · Tool
- [Facebook BitMap Codec](https://awesomerea.org/resources/facebookcodec/index.md) · Tool
- [DevLens Ultra](https://awesomerea.org/resources/devlens-ultra/index.md) · Tool
- [AppThreat wasm-tools](https://awesomerea.org/resources/appthreat-wasm-tools/index.md) · Tool
- [web-crawler ReverseAgent](https://awesomerea.org/resources/web-crawler-reverse-agent/index.md) · Tool
- [Mirrorframe](https://awesomerea.org/resources/mirrorframe/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.