MAL-2026-13120

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-tcs-configs/MAL-2026-13120.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13120
Published
2026-08-05T14:20:47Z
Modified
2026-08-05T15:52:33.329635635Z
Summary
Malicious code in bpm-foundation-tcs-configs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e3a42f343712987873cf8ad18e70cc172666edc3b079149cae4d449ceadf2262)

On require() of the package, index.js loads adapter.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) and *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache<hex>,.analyticsstate, dotnetdiag<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe start /b. Destination hostnames are reconstructed at runtime by splitting the domain into fragments and joining them with.join('') to defeat static URL scanners, and code comments falsely label the behavior as telemetry/CDN negotiation. A DNS-over-TXT fallback channel reassembles a base64 payload from numbered TXT records when HTTP fetch fails. There is no version pin or hash verification on the downloaded binary, a TTL cache suppresses repeat downloads to reduce detection, and DISABLETELEMETRY-style environment variables act as an evasion switch. The dropped filenames impersonate system components (dotnet diagnostics, analytics cache).

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:41.446754058Z",
            "sha256": "e3a42f343712987873cf8ad18e70cc172666edc3b079149cae4d449ceadf2262",
            "id": "IN-MAL-2026-015265",
            "modified_time": "2026-08-05T14:20:47Z",
            "versions": [
                "35.3.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-tcs-configs

Package

Name
bpm-foundation-tcs-configs
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-tcs-configs

Affected ranges

Affected versions

35.*
35.3.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bpm-foundation-tcs-configs-35.3.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-PWZkNpZgYMri4KMS/fsuETJIswpET+XPEldx+RTJPkpRK6MejtG07Mimnva7dnrMGMXsZce2iyVaR0hCu9FCmw==",
                "sha1": "8ec4a4d7eb09cd78cdcf3298e9761e8981f45be7"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "79a1b89a02a670184fb0d7e4c71b4816f65bf66337818284fb9c66944f7352483b2efc",
            "sha256": "23536823045acdb85b3c0acc0d8fecf3ff05861a0fa7faecd844767b5d561ec4",
            "path": "_adapter.js"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-tcs-configs/MAL-2026-13120.json"