{"id":"MAL-2026-12517","summary":"Malicious code in bpm-renovate-renovate-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e)\nOn require, index.js loads setup.js which downloads a platform-specific binary over HTTPS from one of four string-concatenation-obfuscated *.workers.dev hosts (oob-worker.cf100-416.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev, cf99-9b3.workers.dev), with a DNS-TXT-record base64 fallback channel via subdomains of dl.wel1.ru. The fetched payload is written to /tmp or %TEMP% under decoy names (e.g. dotnet_diag_*.exe,.cache_*), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. Hostnames are constructed by joining short substrings at runtime to evade static URL scanning. A companion module lib/telemetry.js contains the same fetch-decode-chmod-spawn pattern using property-name concatenation (fs['chmod'+'Sync'], require('child_'+'process')) and base64 buffer construction. This is a supply-chain dropper delivering arbitrary attacker-controlled native code to any host that installs or requires the package.\n","modified":"2026-08-05T14:35:15.521714324Z","published":"2026-08-05T14:18:50Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015251","import_time":"2026-08-05T14:20:16.766318645Z","modified_time":"2026-08-05T14:18:50Z","sha256":"3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e","source":"amazon-inspector","versions":["35.9.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bpm-renovate-renovate-config/v/35.9.2"}],"affected":[{"package":{"name":"bpm-renovate-renovate-config","ecosystem":"npm","purl":"pkg:npm/bpm-renovate-renovate-config"},"versions":["35.9.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"4fcd54f626437e6f927e2a130cf9adb7882deab684f567f605b5f1113df8bdb6","tlsh":"54a1a79616a670188bb09be4c61b8416f65bf6633781c1d8f79ca5884fb35188372efc"},{"sha256":"eebec37e672cddd4aac4cbb923d89bc68362805e545ce455f6f0731a1b87dd87","tlsh":"02835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js"}],"package_integrity":[{"filename":"bpm-renovate-renovate-config-35.9.2.tgz","hashes":{"sha1":"4978bd2b7cb1f2112d584db174513cc3ea072ce0","sha512_sri":"sha512-HN+zIgMyrPs9UG2+jzj1dc7hGwZnGdYQe3GDZFV5tqpij7iyYbUwPci27c3sUR08wQJFfDKxn8C3o68/DSuBFQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-renovate-renovate-config/MAL-2026-12517.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}