MAL-2026-13100

    Dashboard / Malicious Package / MAL-2026-13100

    MAL-2026-13100

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bpm-foundation-ai-assistant (npm)

    Details: Source: amazon-inspector (13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa) index.js unconditionally requires./_loader on package load. _loader.js assembles Cloudflare Workers hostnames from string-array joins (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, downloads a platform-specific binary via https.get, writes it to /var/tmp/.cache_<hex> or %TEMP%\dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd /c start. Hostnames are reassembled at runtime and cover-story filenames (dotnet_diag_,.cache_,.analytics_state) are used to blend with system paths. A parallel dropper module in lib/telemetry.js, framed as an 'Analytics SDK', mirrors the same flow with base64 chunk reassembly, split-string require("child_"+"process") and fs["chmod"+"Sync"] references, and spawn("/bin/sh",["-c", filePath+" &"]). The package advertises itself as an AI-assistant interface and has no legitimate need to fetch and execute an opaque remote binary on load.

    References: https://www.npmjs.com/package/bpm-foundation-ai-assistant/v/35.6.2

    Affected packages

    Package

    Name: bpm-foundation-ai-assistant

    Purl: pkg:npm/bpm-foundation-ai-assistant

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.6.2