bi-core-bi-core-core

{"schema_version":"1.7.4","id":"MAL-2026-12829","published":"2026-08-05T15:04:01Z","modified":"2026-08-06T01:00:37.794940405Z","aliases":["GHSA-597m-xm3m-3fx5"],"summary":"Malicious code in bi-core-bi-core-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1)\nOn require() of the package, index.js triggers _compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled `oob-worker*.workers.dev` Cloudflare Workers hosts (with a DNS TXT fallback via `*.dl.wel1.ru` subdomains), writes them to /tmp or %TEMP% under disguised names (`.cache_<hex>`, `dotnet_diag_<hex>.exe`), chmods 0755, and spawns them detached via `/bin/sh -c` on Unix or `cmd.exe /c start /b` on Windows. Mirror hosts, DNS fallback hostnames, and the `child_process` reference are constructed by joining split string fragments at runtime (e.g. `[\"oob-work\",\"er.cf100-41\",...].join('')`, `require(\"child_\" + \"process\")`) to defeat static string scans. The package presents itself as a trivial base framework module — index.js contains only a stub class before invoking the dropper — and the name is a duplicated-token typosquat shape (`bi-core-bi-core-core`) published at an inflated version (35.8.5) with no legitimate functionality.\n\n## Source: ghsa-malware (4fd11497fb28d01ff13728d9648b7f2f3a8e84a16d20170c2c97f4a1bfd765ad)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"bi-core-bi-core-core","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["35.8.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"4a9fbe348aa28776d4ad2167b5b0cc11e2f14f1a572ee33fc812ba788ebbce26","tlsh":"31a1875a166670194bb0d7e48b274415f66bf6633390c2d8fb5ca9581fb31288372efc"},{"path":"package.json","sha256":"dafe45b096bc9977e0eda647e42a59afee28c655ca2337778f2a5af5a3181b32","tlsh":"e1c0807345506533507945d05c61514b3b935f1f70f44c073b77215840d0d7914dd357"}],"package_integrity":[{"filename":"bi-core-bi-core-core-35.8.5.tgz","hashes":{"sha1":"8b29fa12ac4c605ac8dd0f90f37ce489a7e0d21c","sha512_sri":"sha512-gHBXox6njZjZ80TBzcA/ESyaVQq0JtzJRVwZ/METj1P2rF8MP68Wa7vJ/XqKmpEf3pAQmbraV64c7nk9GSnKSQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bi-core-bi-core-core/v/35.8.5"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-597m-xm3m-3fx5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015554","import_time":"2026-08-05T15:19:57.70299735Z","modified_time":"2026-08-05T15:04:01Z","sha256":"f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1","source":"amazon-inspector","versions":["35.8.5"]},{"id":"GHSA-597m-xm3m-3fx5","import_time":"2026-08-06T00:58:53.290624874Z","modified_time":"2026-08-05T18:04:56Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"4fd11497fb28d01ff13728d9648b7f2f3a8e84a16d20170c2c97f4a1bfd765ad","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}