MAL-2026-13106

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-bundle-optimization/MAL-2026-13106.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13106
Published
2026-08-05T14:22:23Z
Modified
2026-08-05T15:52:25.793943869Z
Summary
Malicious code in bpm-foundation-bundle-optimization (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616)

Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames (oob-worker.cf10*.workers.dev) and DNS-fallback domains (*.dl.wel1.ru) from split-string arrays joined at runtime, downloads a platform-specific binary over https.get, writes it to /tmp or %TEMP% under decoy names (.cache<hex>, dotnetdiag<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT covert channel reconstructs the payload from base64 chunks served under c.<domain> and N.<domain> when the primary hosts are unreachable. A sibling lib/telemetry.js contains a parallel dropper implementation (fs.chmodSync 0755, cp.spawn '/bin/sh -c... &', base64-chunk reconstruction) staged in the tarball but not on the auto-executed graph of this version. The destination hostnames are not the package's declared publisher, the fetched bytes are unpinned and unverified, and the drop path fires on any require() of the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616",
            "id": "IN-MAL-2026-015275",
            "modified_time": "2026-08-05T14:22:23Z",
            "import_time": "2026-08-05T15:19:42.045249899Z",
            "source": "amazon-inspector",
            "versions": [
                "35.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-bundle-optimization

Package

Name
bpm-foundation-bundle-optimization
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-bundle-optimization

Affected ranges

Affected versions

35.*
35.1.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "0f8f2bf28c6a228928806bb23fc71e0dd1856e245106cad8054a3f7a623a2a7a",
            "path": "_vendor.js",
            "tlsh": "86a1a79a02a9701d8bb0d7e487175416f66bf663338192c4fb6c65984fb712483b2efc"
        },
        {
            "sha256": "e4dfcdf76968c7411ef7399016a90f8c745d404b21baf4fb72bc78b4a495554c",
            "path": "lib/telemetry.js",
            "tlsh": "25835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-ylYOqAgFHOw8CTFkRxoykmfw/Q6WSQxo6lSwusgPih8F01Dl+RzQTDHsHtxaDAaiIbycqkOYZkrrK4Gpf+Aypg==",
                "sha1": "679f894328fd69e1fc5ef194f33b4c867773e911"
            },
            "filename": "bpm-foundation-bundle-optimization-35.1.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-bundle-optimization/MAL-2026-13106.json"