MAL-2026-13105

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-base-configs/MAL-2026-13105.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13105
Published
2026-08-05T14:23:22Z
Modified
2026-08-05T15:52:25.579620892Z
Summary
Malicious code in bpm-foundation-base-configs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293)

On require, index.js loads _helpers.js, which reconstructs C2 hostnames via string-split-join concatenation (['oob-w','orker.cf101-adf.worke','rs','.d','ev'].join('') and similar), selects a platform-specific payload, fetches an opaque binary from those hidden hosts over HTTPS, writes it to /tmp or the Windows temp directory under a disguised filename (dotnet_diag_*.exe / .cache_*), chmods it 0755, and spawns it detached via /bin/sh or cmd.exe (_helpers.js line 125+). If HTTPS retrieval fails, loadViaDns falls back to a DNS-TXT covert channel: it queries c.<domain> for a chunk count then walks 0.<domain>..N.<domain> TXT records (resolver domain reconstructed as ['sdk.dl.we','l1.r','u'].join('')), concatenates the values, base64-decodes them into the executable buffer, and executes through the same write+chmod+spawn sink. No hash or signature verification is performed and the destination hosts have no relationship to the declared package purpose. The behavior fires purely from require() of the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293",
            "id": "IN-MAL-2026-015282",
            "modified_time": "2026-08-05T14:23:22Z",
            "import_time": "2026-08-05T15:19:42.381933893Z",
            "source": "amazon-inspector",
            "versions": [
                "35.6.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-base-configs

Package

Name
bpm-foundation-base-configs
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-base-configs

Affected ranges

Affected versions

35.*
35.6.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "d2a32b90fa53b21bb006f3010f27a107b4d292d897d66d2b8d45ed5183df87a9",
            "path": "_helpers.js",
            "tlsh": "c2a1a75a066a70198bb097e487274816f55bf76333c0c294f79ca9985fb60244372dfc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-lbIreQiML3fP9Wba3l18tuMqlBwVlvLFbGYOWy4qcvawhIPvPlk1R9ku2+XY4ZVUGG6ST4r8mDddzSmu14x/Tw==",
                "sha1": "eef300f3951ea970f651b1133a222f48405fb21f"
            },
            "filename": "bpm-foundation-base-configs-35.6.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-base-configs/MAL-2026-13105.json"