MAL-2026-12516
Dashboard / Malicious Package / MAL-2026-12516
MAL-2026-12516
Summary: Malicious code in bpm-foundation-testing (npm)
Details: Source: amazon-inspector (731f1d13e5958a2b7954d0c472f56bae0663ebc6e0d0e1f2e7c080b70f124c73) index.js unconditionally requires./_platform on load. _platform.js selects a per-OS payload path, fetches bytes from one of three string-concatenation-obfuscated *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT-record fallback channel that reassembles a base64 payload from chunked subdomain lookups against sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory with disguising filenames (dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755'd, and executed detached via `cp.spawn("/bin/sh", ["-c", fp + " &"], { detached: true }).unref()` or the cmd.exe equivalent. Destination hosts are assembled from split string fragments (e.g. `["oob-worker.cf101-adf.w","orkers.de","v"].join("")`) and `child_process` is likewise imported via `require("child_" + "process")` to evade static analysis. A parallel dropper implementation with the same fetch/chmod/spawn shape is bundled in lib/telemetry.js under a `metrics.node` cover story. No hash or signature verification of fetched bytes; payload host is not publisher-owned.
Affected packages
Package
Name: bpm-foundation-testing
Purl: pkg:npm/bpm-foundation-testing
Affected ranges
Type: N/A
Events:
