MAL-2026-13101
Dashboard / Malicious Package / MAL-2026-13101
MAL-2026-13101
Summary: Malicious code in bpm-foundation-analytics (npm)
Details: Source: amazon-inspector (58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e) index.js unconditionally requires./_init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers endpoints (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), assembled at runtime via array-join string splits to evade static scanners. If HTTPS is blocked, _init.js falls back to a covert DNS TXT channel, iterating sequential subdomains of *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru, plus c.<d>, 0.<d>, 1.<d>,...), concatenating the TXT chunks, and base64-decoding them into the same executable payload. The bytes are written to a random path disguised as dotnet_diag_<hex>.exe on Windows or.cache_*/.analytics_state on Unix, chmod 0755, and spawned detached via cmd.exe or /bin/sh -c '<file> &' with.unref(). No hash/signature verification; endpoints are mutable; payload is opaque. Package name 'bpm-foundation-analytics' and telemetry-styled artifact names are cover-story labels; the behavior is remote code execution on any host that requires the package.
Affected packages
Package
Name: bpm-foundation-analytics
Purl: pkg:npm/bpm-foundation-analytics
Affected ranges
Type: N/A
Events:
