bpm-foundation-test-jasmine

{"modified":"2026-08-05T14:19:46Z","published":"2026-08-05T14:19:46Z","schema_version":"1.7.4","id":"MAL-2026-13121","summary":"Malicious code in bpm-foundation-test-jasmine (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e9fd53d190d78da3b8aef57cfd6df656093743bc766ecb0f212c464c74b88319)\nOn require() of the package, index.js loads _bridge.js, which reconstructs Cloudflare Workers hostnames from split string fragments (oob-worker.cf100-416/cf101-adf/cf102-baf.workers.dev) with a DNS TXT chunked base64 fallback via *.dl.wel1.ru, downloads a platform-specific executable, writes it to a hidden temp path (/var/tmp/.cache_<hex> on Unix, %TEMP%/dotnet_diag_<hex>.exe on Windows) chosen to imitate benign OS artifacts, chmods it 0755 on Unix, and detach-spawns it via spawn(\"/bin/sh\",[\"-c\", fp+\" &\"], {detached:true}) or cmd.exe /c start /b. A DISABLE_TELEMETRY-style env gate is used as cover. The package is named as a test harness but the fetched binary is opaque, purpose-mismatched, and executed unconditionally on import.\n","affected":[{"package":{"ecosystem":"npm","name":"bpm-foundation-test-jasmine"},"versions":["35.7.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"2d74c33b022db8753a5bff72d6bcb80549a553b90e447758e6988f7f8a7e8043","tlsh":"e7b1a65a11a570194bb0e7e4c61b8816f56bf663368182c4fb9c69855f73124c3b2dfc"}],"package_integrity":[{"filename":"bpm-foundation-test-jasmine-35.7.9.tgz","hashes":{"sha1":"bf458a7faa09a320b6f677484c9385d2f3b06de9","sha512_sri":"sha512-EVd6euFLsE4LbAf0vQmnUbf162P47F6XmXdjBBNAugRAvMuIuHmwzJnmy7TxZXcW+dAdLdCNoBAGTNRA5fgImw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bpm-foundation-test-jasmine/v/35.7.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015258","import_time":"2026-08-05T15:19:41.067688673Z","modified_time":"2026-08-05T14:19:46Z","sha256":"e9fd53d190d78da3b8aef57cfd6df656093743bc766ecb0f212c464c74b88319","source":"amazon-inspector","versions":["35.7.9"]}]}}