MAL-2026-13112
Dashboard / Malicious Package / MAL-2026-13112
MAL-2026-13112
Summary: Malicious code in bpm-foundation-linters (npm)
Details: Source: amazon-inspector (b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961) On require() of the package, index.js loads _runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) whose hostnames are assembled at runtime by joining fragmented string pieces to evade static analysis. When HTTPS delivery fails, a DNS-TXT covert channel reassembles a base64-encoded payload from numbered TXT records under *.dl.wel1.ru subdomains (also string-fragmented). The retrieved bytes are written to /var/tmp/.cache_<rand> on POSIX or %TEMP%\dotnet_diag_<rand>.exe on Windows (a decoy resembling a legitimate.NET diagnostic tool), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. The package presents itself as a code-style enforcer; none of the fetched or executed content relates to that purpose.
Affected packages
Package
Name: bpm-foundation-linters
Purl: pkg:npm/bpm-foundation-linters
Affected ranges
Type: N/A
Events:
