MAL-2026-10728

    Dashboard / Malicious Package / MAL-2026-10728

    MAL-2026-10728

    Published: 16 Jul 2026Last Modified: 16 Jul 2026

    Summary: Malicious code in bvm-core (npm)

    Details: Source: amazon-inspector (87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca) dist/index.js in [email protected] imports child_process and issues fetch() calls to the hardcoded host https://bvm-core.nexsail.top at the top of the bundled module, alongside a secondary fetch to registry.npmmirror.com. The combination — a lookalike domain that mirrors the package name on an unrelated TLD, module-load-time network calls, and child_process usage in the same bundle — is the fingerprint of an install/import-time beacon and command execution channel, not a legitimate SDK call. The package name resembles established `bvm` version-manager tooling but the code routes traffic to an author-controlled host on nexsail.top rather than to any documented registry or vendor endpoint.

    References: https://www.npmjs.com/package/bvm-core/v/1.1.43, https://www.npmjs.com/package/bvm-core/v/1.1.42

    Affected packages

    Package

    Name: bvm-core

    Purl: pkg:npm/bvm-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.43
    1.1.42