bjm-low-code-components

{"modified":"2026-08-11T18:50:26Z","published":"2026-08-11T18:50:26Z","schema_version":"1.7.4","id":"MAL-2026-13751","summary":"Malicious code in bjm-low-code-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b)\nOn npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and selected environment variables and POSTs them over plain HTTP to a hardcoded Burp Collaborator OAST subdomain at 2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com/bjm-canary. This is a dependency-confusion / reconnaissance beacon: installer-side identity and environment data leave the machine automatically on install to an attacker-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"bjm-low-code-components"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"canary.js","sha256":"d713540d01803126445afaf551daf616d1a6b892a954cb22479f429ce2b8a3ac","tlsh":"f4f0c0e642d4a9650ff8d194f0d4400816b2e14473079490e1bd600a2f9c3b82633dd9"}],"package_integrity":[{"filename":"bjm-low-code-components-99.0.0.tgz","hashes":{"sha1":"8ecff517a69ae92886b74bc005a6b7edb36911e1","sha512_sri":"sha512-B3/ImHC3vuUrPZBsWn+m7JNmnsmZA9voWtt5E82n8Q5kTkoBN/mio6RLPlhBU0CsKkkxNoIBQ/aIi0aOIKoUAg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bjm-low-code-components/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017388","import_time":"2026-08-11T18:52:01.587319807Z","modified_time":"2026-08-11T18:50:26Z","sha256":"f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b","source":"amazon-inspector","versions":["99.0.0"]}]}}