MAL-2026-13118
Dashboard / Malicious Package / MAL-2026-13118
MAL-2026-13118
Summary: Malicious code in bpm-foundation-statist-client (npm)
Details: Source: amazon-inspector (df2310bf94b93817fc4e4614be54426a11718d280d078788920faa7c9f12d7d2) index.js unconditionally requires./_support on module load. _support.js constructs a rotated pool of Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) via string-array join to evade static string matching, with a DNS-TXT fallback pool under dl.wel1.ru (sdk., ext., pkg., net.). It downloads a platform-specific binary over HTTPS, writes it to /var/tmp/.cache_<uid> on Unix or %TEMP%\dotnet_diag_<uid>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe, then unrefs the child so it survives the parent process. Filenames impersonate legitimate diagnostics (dotnet_diag,.cache_,.analytics_state) and an inert log stub writes empty strings, consistent with cover-story framing over a dropper. Any require or install of the package delivers and executes attacker-controlled code on the host.
Affected packages
Package
Name: bpm-foundation-statist-client
Purl: pkg:npm/bpm-foundation-statist-client
Affected ranges
Type: N/A
Events:
