bpm-foundation-api

{"modified":"2026-08-05T14:23:14Z","published":"2026-08-05T14:23:14Z","schema_version":"1.7.4","id":"MAL-2026-13102","summary":"Malicious code in bpm-foundation-api (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5)\nOn require(), index.js loads _polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments (oob-worker.cf10-1-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT-record covert-channel fallback under *.dl.wel1.ru resolvers. The fetched bytes are written to /tmp or %TEMP% under a disguised name (`.cache_<rand>` on Unix, `dotnet_diag_<rand>.exe` on Windows), chmod'd 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', path+' &'], {detached:true, stdio:'ignore'}).unref() (or cmd spawn on Windows). The C2 hostnames and DNS resolver domains are assembled at runtime from arrays of small string fragments to evade static matching. The package advertises itself only as an 'endpoint interface' and has no legitimate need for downloading and executing arbitrary remote binaries at import time.\n","affected":[{"package":{"ecosystem":"npm","name":"bpm-foundation-api"},"versions":["35.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"a99414c5b7aa78b89a6924aea4b7eecf79bad8c56f7fa9802c379d3c5f485253","tlsh":"2fa1b85a16a6b00887b09bf4c7174416f657e6a33781c2d4fb6c65981f7213483b2dfc"}],"package_integrity":[{"filename":"bpm-foundation-api-35.4.2.tgz","hashes":{"sha1":"b0c9011a7c07fd4baccb12b9a2ee0a664156730b","sha512_sri":"sha512-92A1JHB+aNAC4FareG0/wD6quAUkHJK7S93vmBFCchpu2r6VmVzgmiU1HGoomftiK5AkZ7rfl7HMviA9zA1vYg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bpm-foundation-api/v/35.4.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015281","import_time":"2026-08-05T15:19:42.331361656Z","modified_time":"2026-08-05T14:23:14Z","sha256":"bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5","source":"amazon-inspector","versions":["35.4.2"]}]}}