MAL-2026-13118

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-statist-client/MAL-2026-13118.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13118
Published
2026-08-05T14:19:55Z
Modified
2026-08-05T15:52:32.042814307Z
Summary
Malicious code in bpm-foundation-statist-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (df2310bf94b93817fc4e4614be54426a11718d280d078788920faa7c9f12d7d2)

index.js unconditionally requires./support on module load. support.js constructs a rotated pool of Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) via string-array join to evade static string matching, with a DNS-TXT fallback pool under dl.wel1.ru (sdk., ext., pkg., net.). It downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache<uid> on Unix or %TEMP%\dotnetdiag<uid>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe, then unrefs the child so it survives the parent process. Filenames impersonate legitimate diagnostics (dotnetdiag,.cache_,.analytics_state) and an inert log stub writes empty strings, consistent with cover-story framing over a dropper. Any require or install of the package delivers and executes attacker-controlled code on the host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "df2310bf94b93817fc4e4614be54426a11718d280d078788920faa7c9f12d7d2",
            "id": "IN-MAL-2026-015259",
            "modified_time": "2026-08-05T14:19:55Z",
            "import_time": "2026-08-05T15:19:41.139602715Z",
            "source": "amazon-inspector",
            "versions": [
                "35.2.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-statist-client

Package

Name
bpm-foundation-statist-client
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-statist-client

Affected ranges

Affected versions

35.*
35.2.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "2f4e46a2560ba68d7e096442fa53bac35557750945e335159fa452180f95d363",
            "path": "_support.js",
            "tlsh": "bba1859612a670184bb0a7e4c71b4816f65bf6633781c2c4fb5ca5845fb35288372efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-2sjUgE1EkR4Rj7ys02WCkPwuA2XI9FPmCoGwVtFeKcs1iTPYrq6evyOFwQ5KcHDKAetO80qVENdBIzxwUMYlew==",
                "sha1": "8d9ddd67b600195949a3e32bcd26b133ec6946d8"
            },
            "filename": "bpm-foundation-statist-client-35.2.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-statist-client/MAL-2026-13118.json"