MAL-2026-13101

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-analytics/MAL-2026-13101.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13101
Published
2026-08-05T14:22:41Z
Modified
2026-08-05T15:52:23.725087818Z
Summary
Malicious code in bpm-foundation-analytics (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e)

index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), assembled at runtime via array-join string splits to evade static scanners. If HTTPS is blocked, init.js falls back to a covert DNS TXT channel, iterating sequential subdomains of *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru, plus c.<d>, 0.<d>, 1.<d>,...), concatenating the TXT chunks, and base64-decoding them into the same executable payload. The bytes are written to a random path disguised as dotnetdiag<hex>.exe on Windows or.cache_*/.analytics_state on Unix, chmod 0755, and spawned detached via cmd.exe or /bin/sh -c '<file> &' with.unref(). No hash/signature verification; endpoints are mutable; payload is opaque. Package name 'bpm-foundation-analytics' and telemetry-styled artifact names are cover-story labels; the behavior is remote code execution on any host that requires the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e",
            "id": "IN-MAL-2026-015277",
            "modified_time": "2026-08-05T14:22:41Z",
            "import_time": "2026-08-05T15:19:42.146270085Z",
            "source": "amazon-inspector",
            "versions": [
                "35.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-analytics

Package

Name
bpm-foundation-analytics
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-analytics

Affected ranges

Affected versions

35.*
35.5.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "a9a57cf2b10c045108207c7a60a5451b383103e3e3b83d76f0febc44acdd75ac",
            "path": "_init.js",
            "tlsh": "46a175a6066670188bb0d7e4c7075415f65be563778092d4fb9c65981ff322883b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-9wmiMEgDmXhpi/4rNJYQy69DkDAEmUBsHwLKZ2jI62Jxtcj2J48SuzTp61RKv3p2Pqe/NyK1wI2RnuYTaPtUxw==",
                "sha1": "b231d8f052104662f15a9c005803f1001ad5a300"
            },
            "filename": "bpm-foundation-analytics-35.5.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-analytics/MAL-2026-13101.json"