MAL-2026-13113

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-nest-keycloak-connect/MAL-2026-13113.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13113
Published
2026-08-05T14:20:38Z
Modified
2026-08-05T15:52:29.628627476Z
Summary
Malicious code in bpm-foundation-nest-keycloak-connect (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955)

On require() of the package, index.js loads shim.js which detects OS and architecture, then downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled by string-array join to evade static scans (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT fallback channel over *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (dotnetdiag_*,.cache_*), chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref() (or cmd on Windows). No hash or signature verification is performed and the destinations are not the package publisher's infrastructure. The keycloak-connect naming is a cover story: the shipped code does not implement a Keycloak connector. An additional ~81KB lib/telemetry.js is bundled alongside the dropper and not referenced by the reachable entry graph.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:20:38Z",
            "source": "amazon-inspector",
            "sha256": "6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955",
            "import_time": "2026-08-05T15:19:41.40763489Z",
            "id": "IN-MAL-2026-015264",
            "versions": [
                "35.8.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-nest-keycloak-connect

Package

Name
bpm-foundation-nest-keycloak-connect
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-nest-keycloak-connect

Affected ranges

Affected versions

35.*
35.8.6

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bpm-foundation-nest-keycloak-connect-35.8.6.tgz",
            "hashes": {
                "sha512_sri": "sha512-MdvmUmVZ4LHceKrIMjU9yP7G1n6lw8nmduH+1ucDPHMFsAnaVOylV/pEVTsn76zdc3kmI8EyrtTzSqiEhj0lLA==",
                "sha1": "bfa59176baf35981eff760503ce7ea39337492b9"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "0ca1635a126630188bb0ebe4c71b4419f65af66327819295fb5c68985fb3128c3b1efc",
            "sha256": "556616a341ea5fe9635c03d88aa325b8248959fbca909ba273c46b84b245ca49",
            "path": "_shim.js"
        },
        {
            "tlsh": "06835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "a56fea255feff09fc359066fdd8f5e63262025dbd3c21b30c09d3f2b891256f9",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-nest-keycloak-connect/MAL-2026-13113.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]