MAL-2026-13121

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-test-jasmine/MAL-2026-13121.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13121
Published
2026-08-05T14:19:46Z
Modified
2026-08-05T15:52:33.433450256Z
Summary
Malicious code in bpm-foundation-test-jasmine (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e9fd53d190d78da3b8aef57cfd6df656093743bc766ecb0f212c464c74b88319)

On require() of the package, index.js loads bridge.js, which reconstructs Cloudflare Workers hostnames from split string fragments (oob-worker.cf100-416/cf101-adf/cf102-baf.workers.dev) with a DNS TXT chunked base64 fallback via *.dl.wel1.ru, downloads a platform-specific executable, writes it to a hidden temp path (/var/tmp/.cache<hex> on Unix, %TEMP%/dotnetdiag<hex>.exe on Windows) chosen to imitate benign OS artifacts, chmods it 0755 on Unix, and detach-spawns it via spawn("/bin/sh",["-c", fp+" &"], {detached:true}) or cmd.exe /c start /b. A DISABLE_TELEMETRY-style env gate is used as cover. The package is named as a test harness but the fetched binary is opaque, purpose-mismatched, and executed unconditionally on import.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T15:19:41.067688673Z",
            "sha256": "e9fd53d190d78da3b8aef57cfd6df656093743bc766ecb0f212c464c74b88319",
            "modified_time": "2026-08-05T14:19:46Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015258",
            "versions": [
                "35.7.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bpm-foundation-test-jasmine

Package

Name
bpm-foundation-test-jasmine
View open source insights on deps.dev
Purl
pkg:npm/bpm-foundation-test-jasmine

Affected ranges

Affected versions

35.*
35.7.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-test-jasmine/MAL-2026-13121.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "2d74c33b022db8753a5bff72d6bcb80549a553b90e447758e6988f7f8a7e8043",
            "path": "_bridge.js",
            "tlsh": "e7b1a65a11a570194bb0e7e4c61b8816f56bf663368182c4fb9c69855f73124c3b2dfc"
        }
    ],
    "package_integrity": [
        {
            "filename": "bpm-foundation-test-jasmine-35.7.9.tgz",
            "hashes": {
                "sha1": "bf458a7faa09a320b6f677484c9385d2f3b06de9",
                "sha512_sri": "sha512-EVd6euFLsE4LbAf0vQmnUbf162P47F6XmXdjBBNAugRAvMuIuHmwzJnmy7TxZXcW+dAdLdCNoBAGTNRA5fgImw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]