MAL-2026-12517

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-renovate-renovate-config/MAL-2026-12517.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12517
Published
2026-08-05T14:18:50Z
Modified
2026-08-05T14:35:15.521714324Z
Summary
Malicious code in bpm-renovate-renovate-config (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e)

On require, index.js loads setup.js which downloads a platform-specific binary over HTTPS from one of four string-concatenation-obfuscated .workers.dev hosts (oob-worker.cf100-416.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev), with a DNS-TXT-record base64 fallback channel via subdomains of dl.wel1.ru. The fetched payload is written to /tmp or %TEMP% under decoy names (e.g. dotnetdiag.exe,.cache_*), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. Hostnames are constructed by joining short substrings at runtime to evade static URL scanning. A companion module lib/telemetry.js contains the same fetch-decode-chmod-spawn pattern using property-name concatenation (fs['chmod'+'Sync'], require('child_'+'process')) and base64 buffer construction. This is a supply-chain dropper delivering arbitrary attacker-controlled native code to any host that installs or requires the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e",
            "id": "IN-MAL-2026-015251",
            "modified_time": "2026-08-05T14:18:50Z",
            "import_time": "2026-08-05T14:20:16.766318645Z",
            "source": "amazon-inspector",
            "versions": [
                "35.9.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-renovate-renovate-config

Package

Name
bpm-renovate-renovate-config
View open source insights on deps.dev
Purl
pkg:npm/bpm-renovate-renovate-config

Affected ranges

Affected versions

35.*
35.9.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "4fcd54f626437e6f927e2a130cf9adb7882deab684f567f605b5f1113df8bdb6",
            "path": "setup.js",
            "tlsh": "54a1a79616a670188bb09be4c61b8416f65bf6633781c1d8f79ca5884fb35188372efc"
        },
        {
            "sha256": "eebec37e672cddd4aac4cbb923d89bc68362805e545ce455f6f0731a1b87dd87",
            "path": "lib/telemetry.js",
            "tlsh": "02835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-HN+zIgMyrPs9UG2+jzj1dc7hGwZnGdYQe3GDZFV5tqpij7iyYbUwPci27c3sUR08wQJFfDKxn8C3o68/DSuBFQ==",
                "sha1": "4978bd2b7cb1f2112d584db174513cc3ea072ce0"
            },
            "filename": "bpm-renovate-renovate-config-35.9.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-renovate-renovate-config/MAL-2026-12517.json"