bpm-foundation-tcs-configs

{"modified":"2026-08-05T14:20:47Z","published":"2026-08-05T14:20:47Z","schema_version":"1.7.4","id":"MAL-2026-13120","summary":"Malicious code in bpm-foundation-tcs-configs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e3a42f343712987873cf8ad18e70cc172666edc3b079149cae4d449ceadf2262)\nOn require() of the package, index.js loads _adapter.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) and *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache_<hex>,.analytics_state, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe start /b. Destination hostnames are reconstructed at runtime by splitting the domain into fragments and joining them with.join('') to defeat static URL scanners, and code comments falsely label the behavior as telemetry/CDN negotiation. A DNS-over-TXT fallback channel reassembles a base64 payload from numbered TXT records when HTTP fetch fails. There is no version pin or hash verification on the downloaded binary, a TTL cache suppresses repeat downloads to reduce detection, and DISABLE_TELEMETRY-style environment variables act as an evasion switch. The dropped filenames impersonate system components (dotnet diagnostics, analytics cache).\n","affected":[{"package":{"ecosystem":"npm","name":"bpm-foundation-tcs-configs"},"versions":["35.3.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"23536823045acdb85b3c0acc0d8fecf3ff05861a0fa7faecd844767b5d561ec4","tlsh":"79a1b89a02a670184fb0d7e4c71b4816f65bf66337818284fb9c66944f7352483b2efc"}],"package_integrity":[{"filename":"bpm-foundation-tcs-configs-35.3.3.tgz","hashes":{"sha1":"8ec4a4d7eb09cd78cdcf3298e9761e8981f45be7","sha512_sri":"sha512-PWZkNpZgYMri4KMS/fsuETJIswpET+XPEldx+RTJPkpRK6MejtG07Mimnva7dnrMGMXsZce2iyVaR0hCu9FCmw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bpm-foundation-tcs-configs/v/35.3.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015265","import_time":"2026-08-05T15:19:41.446754058Z","modified_time":"2026-08-05T14:20:47Z","sha256":"e3a42f343712987873cf8ad18e70cc172666edc3b079149cae4d449ceadf2262","source":"amazon-inspector","versions":["35.3.3"]}]}}