MAL-2026-13102

Dashboard / Malicious Package / MAL-2026-13102

MAL-2026-13102

Summary: Malicious code in bpm-foundation-api (npm)

Details: Source: amazon-inspector (bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5) On require(), index.js loads _polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments (oob-worker.cf10-1-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT-record covert-channel fallback under *.dl.wel1.ru resolvers. The fetched bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<rand>` on Unix, `dotnet_diag_<rand>.exe` on Windows), chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', path+' &'], {detached:true, stdio:'ignore'}).unref() (or cmd spawn on Windows). The C2 hostnames and DNS resolver domains are assembled at runtime from arrays of small string fragments to evade static matching. The package advertises itself only as an 'endpoint interface' and has no legitimate need for downloading and executing arbitrary remote binaries at import time.

References: https://www.npmjs.com/package/bpm-foundation-api/v/35.4.2