MAL-2026-13107

    Dashboard / Malicious Package / MAL-2026-13107

    MAL-2026-13107

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bpm-foundation-common (npm)

    Details: Source: amazon-inspector (39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91) On require('bpm-foundation-common'), index.js loads _loader.js which assembles C2 hostnames via runtime string-joining (e.g. ["oob-worker.","cf101-adf.","workers.d","ev"].join("")) with a DNS-TXT fallback to *.wel1.ru subdomains, downloads a platform-specific binary via https.get, writes it to /tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe, chmods 0755, and detached-spawns it via /bin/sh -c or cmd.exe. Dangerous API names are obfuscated (require("child_"+"process"), fs["chmod"+"Sync"]) to evade static analysis. A second dropper implementation with the same machinery (base64-decoded payload, /bin/sh -c spawn, chmod 0755) is bundled in lib/telemetry.js as an alternate payload path. The package has no documented native-build purpose that would justify fetching and executing a remote binary on require().

    References: https://www.npmjs.com/package/bpm-foundation-common/v/35.9.1

    Affected packages

    Package

    Name: bpm-foundation-common

    Purl: pkg:npm/bpm-foundation-common

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.9.1
    MAL-2026-13107 | CVE-DB