MAL-2026-13103

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-app-configs/MAL-2026-13103.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13103
Published
2026-08-05T14:22:06Z
Modified
2026-08-05T15:52:24.041636137Z
Summary
Malicious code in bpm-foundation-app-configs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d87f6d54acae2240012663e4a9fa4dbd88b953dfe0669b1717887656f0554f7b)

index.js requires./setup on load. setup.js reassembles obfuscated hostnames via array-join (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev and *.dl.wel1.ru resolvers including sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), downloads a per-platform native binary from /pkg/package[.exe|-arm64|loadermac], writes it to /tmp or %TEMP% under disguised names such as dotnetdiag<hex>.exe or.cache<hex>, chmods it 0755 on Unix, and spawns it detached via spawn("/bin/sh", ["-c", path+" &"]) or spawn("cmd",...). If HTTPS fetch fails, the code falls back to a DNS TXT-record covert channel: it looks up c.<domain> for a chunk count, retrieves N chunks from <i>.<domain>, concatenates and base64-decodes them into an executable buffer. Cover-story artifacts (analyticsstate file, DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK env checks, telemetry comments) are contradicted by the manifest description of a configuration loader and the absence of any documented endpoint. The dropper fires whenever any consumer requires the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "d87f6d54acae2240012663e4a9fa4dbd88b953dfe0669b1717887656f0554f7b",
            "id": "IN-MAL-2026-015273",
            "modified_time": "2026-08-05T14:22:06Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:41.937778804Z",
            "versions": [
                "35.9.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-app-configs

Package

Name
bpm-foundation-app-configs
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-app-configs

Affected ranges

Affected versions

35.*
35.9.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "63f8e38f55b6859707a6fe86e9525945e5b08bd60c3d67de1a41817ddafb9c77",
            "path": "setup.js",
            "tlsh": "46a1b69b12a6601d4bb097e4c71b4416f65bf66333c0c295fb9ca5981f7212883b1efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-neBQm+AmN51GzmeV8lZxHP64GKWzqDZYAcQGqzUEOVbaK3VXIIq+W3HLDM23TZ47EOTSPoCpjTrv53uEtULDGA==",
                "sha1": "67b7cb3760abe4a49366ead859e463403e6b9360"
            },
            "filename": "bpm-foundation-app-configs-35.9.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-app-configs/MAL-2026-13103.json"