MAL-2026-13105

Dashboard / Malicious Package / MAL-2026-13105

MAL-2026-13105

Summary: Malicious code in bpm-foundation-base-configs (npm)

Details: Source: amazon-inspector (d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293) On require, index.js loads _helpers.js, which reconstructs C2 hostnames via string-split-join concatenation (`['oob-w','orker.cf101-adf.worke','rs','.d','ev'].join('')` and similar), selects a platform-specific payload, fetches an opaque binary from those hidden hosts over HTTPS, writes it to /tmp or the Windows temp directory under a disguised filename (`dotnet_diag_*.exe` / `.cache_*`), chmods it 0755, and spawns it detached via `/bin/sh` or `cmd.exe` (_helpers.js line 125+). If HTTPS retrieval fails, `loadViaDns` falls back to a DNS-TXT covert channel: it queries `c.<domain>` for a chunk count then walks `0.<domain>..N.<domain>` TXT records (resolver domain reconstructed as `['sdk.dl.we','l1.r','u'].join('')`), concatenates the values, base64-decodes them into the executable buffer, and executes through the same write+chmod+spawn sink. No hash or signature verification is performed and the destination hosts have no relationship to the declared package purpose. The behavior fires purely from `require()` of the package.

References: https://www.npmjs.com/package/bpm-foundation-base-configs/v/35.6.2