MAL-2026-13102

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-api/MAL-2026-13102.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13102
Published
2026-08-05T14:23:14Z
Modified
2026-08-05T15:52:23.722183185Z
Summary
Malicious code in bpm-foundation-api (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5)

On require(), index.js loads _polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments (oob-worker.cf10-1-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT-record covert-channel fallback under *.dl.wel1.ru resolvers. The fetched bytes are written to /tmp or %TEMP% under a disguised name (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', path+' &'], {detached:true, stdio:'ignore'}).unref() (or cmd spawn on Windows). The C2 hostnames and DNS resolver domains are assembled at runtime from arrays of small string fragments to evade static matching. The package advertises itself only as an 'endpoint interface' and has no legitimate need for downloading and executing arbitrary remote binaries at import time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5",
            "id": "IN-MAL-2026-015281",
            "modified_time": "2026-08-05T14:23:14Z",
            "import_time": "2026-08-05T15:19:42.331361656Z",
            "source": "amazon-inspector",
            "versions": [
                "35.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-api

Package

Name
bpm-foundation-api
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-api

Affected ranges

Affected versions

35.*
35.4.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "a99414c5b7aa78b89a6924aea4b7eecf79bad8c56f7fa9802c379d3c5f485253",
            "path": "_polyfill.js",
            "tlsh": "2fa1b85a16a6b00887b09bf4c7174416f657e6a33781c2d4fb6c65981f7213483b2dfc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-92A1JHB+aNAC4FareG0/wD6quAUkHJK7S93vmBFCchpu2r6VmVzgmiU1HGoomftiK5AkZ7rfl7HMviA9zA1vYg==",
                "sha1": "b0c9011a7c07fd4baccb12b9a2ee0a664156730b"
            },
            "filename": "bpm-foundation-api-35.4.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-api/MAL-2026-13102.json"