MAL-2026-13116

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-renovate/MAL-2026-13116.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13116
Published
2026-08-05T14:20:02Z
Modified
2026-08-05T15:52:30.921573003Z
Summary
Malicious code in bpm-foundation-renovate (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a14b30ee8591115098467b468c9e7bb84ae57d52b7d7cdf36799e0a95f94a439)

On require() of the package, index.js loads helpers.js which selects a platform-specific endpoint, downloads a binary from a rotating list of Cloudflare Workers hosts (oob-worker.cf*.workers.dev, assembled at runtime by splitting the hostname across array literals) with a DNS-TXT chunked-fetch fallback to sdk.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name ("dotnetdiag<tag>.exe" on Windows, ".cache<tag>" on POSIX), chmods 755, and detaches it via cp.spawn("/bin/sh", ["-c", filePath+" &"], {detached:true}) or cmd.exe. A companion file lib/telemetry.js repeats the same drop-and-exec primitive (base64 chunk assembly, fs.chmodSync to 755, /bin/sh spawn) behind an "Analytics SDK" facade, and the flag file is named ".analyticsstate" and honors DISABLETELEMETRY/DONOTTRACK as cover. Hostnames, output filenames, and cover strings are runtime-obfuscated. Installing and importing this package results in execution of attacker-controlled code from a publisher-unrelated, mutable host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015260",
            "import_time": "2026-08-05T15:19:41.200203363Z",
            "sha256": "a14b30ee8591115098467b468c9e7bb84ae57d52b7d7cdf36799e0a95f94a439",
            "modified_time": "2026-08-05T14:20:02Z",
            "source": "amazon-inspector",
            "versions": [
                "35.2.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-renovate

Package

Name
bpm-foundation-renovate
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-renovate

Affected ranges

Affected versions

35.*
35.2.8

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_helpers.js",
            "tlsh": "e7b1965616aa70184bb0ebf0c7174416f65af56337809294fb9c65d41fb312883b2efc",
            "sha256": "9f915d8af54c12ba46880be9e32cbe0656902f9798b5efb87698ca8e616a4456"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "35835056566a142186b2b368df234107ff3685272642429dbafc82dc1fbd72092a5ffc",
            "sha256": "9d2afee482fd6afa687eadbf277c2fe90c43df62a43bff7181884301f00bafa1"
        }
    ],
    "package_integrity": [
        {
            "filename": "bpm-foundation-renovate-35.2.8.tgz",
            "hashes": {
                "sha512_sri": "sha512-PllGs6NftQ8CCp25k9+W7y0PhWHJQ3XVHSzPWvFG4W9DwKc7Wh1QhGD4Al7AYffc8BCiULGA3+GsaSq0C06cEQ==",
                "sha1": "2ea962ff535d5ade2941f13faed3d17a1b26ea43"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-renovate/MAL-2026-13116.json"