bpm-foundation-test-jest

{"modified":"2026-08-05T14:19:29Z","published":"2026-08-05T14:19:29Z","schema_version":"1.7.4","id":"MAL-2026-12515","summary":"Malicious code in bpm-foundation-test-jest (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e)\nOn require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments (resolving to oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT fallback channel to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The script downloads a platform-specific binary via https.get, writes it to /var/tmp or %TEMP% under disguised names (dotnet_diag_<rand>.exe,.cache_<rand>), chmods 0755, and spawns it detached through /bin/sh -c or cmd.exe. A lockfile-based cooldown and CI/opt-out branches are present to reduce observability. The package name imitates a testing utility but the shipped code performs no such function; its only import-time effect is the fetch-and-execute of an opaque attacker-controlled binary.\n","affected":[{"package":{"ecosystem":"npm","name":"bpm-foundation-test-jest"},"versions":["35.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"9df73e1f3666dee7d135b9aa00171b68a90f420d611327a848acf51343363db2","tlsh":"d6a1865a167a30194bb0a7f4c717441afa5af663338086d4fb5c65d81fb612483b2efc"}],"package_integrity":[{"filename":"bpm-foundation-test-jest-35.9.3.tgz","hashes":{"sha1":"ea3769128c303d3f5532c5109f8d4727be7e4cd8","sha512_sri":"sha512-hMKvJ4UMSQkMGjfPJcCHDVYvIes+ynxerNhqjHNNxJBC2u5kecpRX00Da1l66A/XE29GaH7f3CEUS1shbsct8w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bpm-foundation-test-jest/v/35.9.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015256","import_time":"2026-08-05T14:20:17.182683381Z","modified_time":"2026-08-05T14:19:29Z","sha256":"de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e","source":"amazon-inspector","versions":["35.9.3"]}]}}