MAL-2026-13107

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-common/MAL-2026-13107.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13107
Published
2026-08-05T14:22:16Z
Modified
2026-08-05T15:52:26.002455378Z
Summary
Malicious code in bpm-foundation-common (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91)

On require('bpm-foundation-common'), index.js loads loader.js which assembles C2 hostnames via runtime string-joining (e.g. ["oob-worker.","cf101-adf.","workers.d","ev"].join("")) with a DNS-TXT fallback to *.wel1.ru subdomains, downloads a platform-specific binary via https.get, writes it to /tmp/.cache<hex> or %TEMP%/dotnetdiag<hex>.exe, chmods 0755, and detached-spawns it via /bin/sh -c or cmd.exe. Dangerous API names are obfuscated (require("child_"+"process"), fs["chmod"+"Sync"]) to evade static analysis. A second dropper implementation with the same machinery (base64-decoded payload, /bin/sh -c spawn, chmod 0755) is bundled in lib/telemetry.js as an alternate payload path. The package has no documented native-build purpose that would justify fetching and executing a remote binary on require().

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91",
            "id": "IN-MAL-2026-015274",
            "modified_time": "2026-08-05T14:22:16Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:41.991011515Z",
            "versions": [
                "35.9.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-common

Package

Name
bpm-foundation-common
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-common

Affected ranges

Affected versions

35.*
35.9.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "db5ae801a828d3c44f348080b619dea664b177986f50bdfa8693463832d69aa1",
            "path": "_loader.js",
            "tlsh": "2ba1b7aa116a71084b70ebe4c7174415f65bf6633780c284fb6c55885fb6128c3b1efc"
        },
        {
            "sha256": "f4d98252df56571f530d52e14912dea2e6fc907cf4bea6853e5c537f7fd32f31",
            "path": "lib/telemetry.js",
            "tlsh": "b0835055566a602186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-pTHFz7RAamBjoGZkhXQqvTbzPpqZ9tpN2EUMiiXCZ1R7jatIC2rO440n7ZAtjx4l2VyyUtWe1hhz3FumyMMwOA==",
                "sha1": "7cd2c89a58002517c902a2a795e7a455be9802fc"
            },
            "filename": "bpm-foundation-common-35.9.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-common/MAL-2026-13107.json"