MAL-2026-12829

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bi-core-bi-core-core/MAL-2026-12829.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12829
Aliases
  • GHSA-597m-xm3m-3fx5
Published
2026-08-05T15:04:01Z
Modified
2026-08-06T01:19:50.061757618Z
Summary
Malicious code in bi-core-bi-core-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1)

On require() of the package, index.js triggers _compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled oob-worker*.workers.dev Cloudflare Workers hosts (with a DNS TXT fallback via *.dl.wel1.ru subdomains), writes them to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns them detached via /bin/sh -c on Unix or cmd.exe /c start /b on Windows. Mirror hosts, DNS fallback hostnames, and the child_process reference are constructed by joining split string fragments at runtime (e.g. ["oob-work","er.cf100-41",...].join(''), require("child_" + "process")) to defeat static string scans. The package presents itself as a trivial base framework module — index.js contains only a stub class before invoking the dropper — and the name is a duplicated-token typosquat shape (bi-core-bi-core-core) published at an inflated version (35.8.5) with no legitimate functionality.

Source: ghsa-malware (4fd11497fb28d01ff13728d9648b7f2f3a8e84a16d20170c2c97f4a1bfd765ad)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:04:01Z",
            "versions": [
                "35.8.5"
            ],
            "sha256": "f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1",
            "import_time": "2026-08-05T15:19:57.70299735Z",
            "id": "IN-MAL-2026-015554"
        },
        {
            "source": "ghsa-malware",
            "modified_time": "2026-08-05T18:04:56Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "import_time": "2026-08-06T00:58:53.290624874Z",
            "sha256": "4fd11497fb28d01ff13728d9648b7f2f3a8e84a16d20170c2c97f4a1bfd765ad",
            "id": "GHSA-597m-xm3m-3fx5"
        }
    ]
}
References
Credits

Affected packages

npm / bi-core-bi-core-core

Package

Name
bi-core-bi-core-core
View open source insights on deps.dev
Purl
pkg:npm/bi-core-bi-core-core

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

35.*
35.8.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bi-core-bi-core-core/MAL-2026-12829.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "bi-core-bi-core-core-35.8.5.tgz",
            "hashes": {
                "sha1": "8b29fa12ac4c605ac8dd0f90f37ce489a7e0d21c",
                "sha512_sri": "sha512-gHBXox6njZjZ80TBzcA/ESyaVQq0JtzJRVwZ/METj1P2rF8MP68Wa7vJ/XqKmpEf3pAQmbraV64c7nk9GSnKSQ=="
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_compat.js",
            "sha256": "4a9fbe348aa28776d4ad2167b5b0cc11e2f14f1a572ee33fc812ba788ebbce26",
            "tlsh": "31a1875a166670194bb0d7e48b274415f66bf6633390c2d8fb5ca9581fb31288372efc"
        },
        {
            "path": "package.json",
            "sha256": "dafe45b096bc9977e0eda647e42a59afee28c655ca2337778f2a5af5a3181b32",
            "tlsh": "e1c0807345506533507945d05c61514b3b935f1f70f44c073b77215840d0d7914dd357"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]