bpm-foundation-date-range

{"modified":"2026-08-05T14:21:50Z","published":"2026-08-05T14:21:50Z","schema_version":"1.7.4","id":"MAL-2026-13108","summary":"Malicious code in bpm-foundation-date-range (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fac5d5e2ebbf743977ac3ac1149da83ee41c1b7b98b10e97619e83fd3a18550c)\nRequiring the package's main entry triggers _polyfill.js, which selects a platform-specific endpoint and downloads a native binary over HTTPS from hostnames assembled by Array.join from split string fragments (Cloudflare Workers mirrors such as oob-worker.cf*-*.workers.de). If HTTPS mirrors fail, a covert DNS-TXT retrieval channel keyed by platform (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) reconstructs the binary from base64-chunked TXT records. The downloaded bytes are written to /tmp or %TEMP% under disguised names (dotnet_diag_<hex>.exe,.cache_<hex>), chmodded 0755 on POSIX, and spawned detached via /bin/sh -c \"<path> &\" or cmd.exe /c start. No hash or signature is verified, the payload host is not the package publisher, and the package's advertised purpose (a date-range utility) has no legitimate need to fetch or run a native binary.\n","affected":[{"package":{"ecosystem":"npm","name":"bpm-foundation-date-range"},"versions":["35.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"320ae65f8369c10b21629b147922fe5996ad1d94ffd15af6a5e8e4641baeb417","tlsh":"cea1759a1566710847b0e7e4c7175416fa5af6633381c2c8f79c99941f7312483b2efc"}],"package_integrity":[{"filename":"bpm-foundation-date-range-35.4.2.tgz","hashes":{"sha1":"d948ebd1ceda8c74344468744ce67e02dd933ccb","sha512_sri":"sha512-/Ul+DAHvjcltQvPFYxM/l7cjfJfDRHfUf1urFlg/+w7k9NTjytIymsep6vR95rC+iXeVzeDALVLAVrj+Gp/pEw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bpm-foundation-date-range/v/35.4.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015271","import_time":"2026-08-05T15:19:41.816624397Z","modified_time":"2026-08-05T14:21:50Z","sha256":"fac5d5e2ebbf743977ac3ac1149da83ee41c1b7b98b10e97619e83fd3a18550c","source":"amazon-inspector","versions":["35.4.2"]}]}}