MAL-2026-13119

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-storage/MAL-2026-13119.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13119
Published
2026-08-05T14:21:36Z
Modified
2026-08-05T15:52:32.373534591Z
Summary
Malicious code in bpm-foundation-storage (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f)

On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts on the *.workers.dev and *.dl.wel1.ru namespaces (with a DNS TXT-record fallback that base64-decodes concatenated chunks into a binary), writes it to a temp directory under a masquerading name such as dotnetdiag<hex>.exe on Windows or.cache<hex> on POSIX, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification, destinations are reconstructed at runtime from split substring arrays, and a secondary DNS-over-TXT loader provides resilience against domain blocking. Any consumer that require()s bpm-foundation-storage triggers execution of attacker-controlled code on the installer's host. The package's declared purpose is a storage library; none of the observed behavior is consistent with that purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T15:19:41.771130596Z",
            "modified_time": "2026-08-05T14:21:36Z",
            "id": "IN-MAL-2026-015270",
            "sha256": "9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f",
            "versions": [
                "35.8.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-storage

Package

Name
bpm-foundation-storage
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-storage

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-storage/MAL-2026-13119.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-M6YCG4BxUsnW7V7HGyDwEOXHcmNB+Pc33kLTrd8QtJaCQZ42Pdb3HStiFMtQSId8YLrXF7psVw9tPlqIrua1vw==",
                "sha1": "eb8efa098f87997dfcc938a2d5c33a38bb20f1af"
            },
            "filename": "bpm-foundation-storage-35.8.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_ext.js",
            "sha256": "08c03035adf365cd60a02554d98cbcfee41196bbb86f9ad61e0acc8ed207bd9b",
            "tlsh": "45a1855a12aa701847b0a7f4c7174416f65bf6633380c598f75ca5941f7212483b2efc"
        }
    ]
}