MAL-2026-10728

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bvm-core/MAL-2026-10728.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10728
Published
2026-07-16T18:46:49Z
Modified
2026-07-16T19:19:42.939608404Z
Summary
Malicious code in bvm-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca)

dist/index.js in bvm-core@1.1.43 imports childprocess and issues fetch() calls to the hardcoded host https://bvm-core.nexsail.top at the top of the bundled module, alongside a secondary fetch to registry.npmmirror.com. The combination — a lookalike domain that mirrors the package name on an unrelated TLD, module-load-time network calls, and childprocess usage in the same bundle — is the fingerprint of an install/import-time beacon and command execution channel, not a legitimate SDK call. The package name resembles established bvm version-manager tooling but the code routes traffic to an author-controlled host on nexsail.top rather than to any documented registry or vendor endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-16T18:46:49Z",
            "sha256": "87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca",
            "versions": [
                "1.1.43"
            ],
            "import_time": "2026-07-16T18:54:04.541874387Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010781"
        },
        {
            "modified_time": "2026-07-16T18:47:00Z",
            "sha256": "f8ba5a35e4424e78202f6d7af907dd7e46b6381b81eba8bbabb126a2e02579c1",
            "versions": [
                "1.1.42"
            ],
            "import_time": "2026-07-16T18:54:04.603193561Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010782"
        }
    ]
}
References
Credits

Affected packages

npm / bvm-core

Package

Name
bvm-core
View open source insights on deps.dev
Purl
pkg:npm/bvm-core

Affected ranges

Affected versions

1.*
1.1.42
1.1.43

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "bvm-core-1.1.43.tgz",
            "hashes": {
                "sha1": "5c06c4d7acd93259c65e5458fc8e3de1024218fd",
                "sha512_sri": "sha512-x3XljrU08cuASnp4e8e6fBIvU2KOIWsYA7RAD/FgW4fOYUvIejV9Hpxa4uGk5/T6h9Oerjx6qYptRZ3kNMOlhw=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "4e831916a7ff653363a87265a9160000a7b8c75b0a04d40af2fcb54a2f7c5985ef7f78",
            "sha256": "be83f4e63f0a2b5771601b028c761d005d434619a4fb3fc82b7a6916b6bcaf61",
            "path": "dist/index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bvm-core/MAL-2026-10728.json"