{"id":"MAL-2026-12519","summary":"Malicious code in bs-bs-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3f3619c5623fc30ab616c89c04badd56a5f3de98cba7a625b647ce98921a65f6)\nOn require('bs-bs-core'), index.js loads _compat.js, which at module load time assembles Cloudflare Workers hostnames from split string arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, with a DNS TXT-record fallback under *.dl.wel1.ru), downloads a platform-specific executable via https.get, writes it to /tmp as '.cache_\u003chex\u003e' or to Windows TEMP as 'dotnet_diag_\u003chex\u003e.exe', chmods 755 on Unix, and spawns it detached via /bin/sh -c or cmd. A stamp file named '.analytics_state' is used to gate re-execution. lib/telemetry.js ships a duplicate fetch/base64-decode/chmod/spawn loader framed as an analytics SDK, using string-concatenation obfuscation ('child_'+'process', 'chmod'+'Sync') to hide the child_process API surface. Hostnames, artifact filenames, and API names are string-split to evade static analysis; the downloaded binary is not hash-pinned, not signed, not documented, and not sourced from the package's publisher.\n","modified":"2026-08-05T14:35:16.828069137Z","published":"2026-08-05T14:18:15Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.1.6"],"id":"IN-MAL-2026-015247","import_time":"2026-08-05T14:20:16.407853789Z","modified_time":"2026-08-05T14:18:15Z","sha256":"3f3619c5623fc30ab616c89c04badd56a5f3de98cba7a625b647ce98921a65f6"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bs-bs-core/v/35.1.6"}],"affected":[{"package":{"name":"bs-bs-core","ecosystem":"npm","purl":"pkg:npm/bs-bs-core"},"versions":["35.1.6"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"b301a95d680c2aee1b9232e3d1311ca19a10c47d673e577f591483b9c39b77e4","tlsh":"b1a1a79616a670184fb0e7e0c7074816f65bf66337819288fb9ca5844f725248372efc"},{"tlsh":"dd835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"8e12631ab59b56f53c1a0c505683bff5e5aa3086e71f5557f01b955bce5ec1d9"}],"package_integrity":[{"filename":"bs-bs-core-35.1.6.tgz","hashes":{"sha512_sri":"sha512-HFSBuSJVGmd8OK6KW8KMxYyhuZHhZwFMNDOlfPcufeCk/yKr5fvqYp9vnQsVaUTleUv3vJhqMFFwFI/TaRPOAA==","sha1":"b6f6263fe00911f7d215d93ddef07a780e09c140"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bs-bs-core/MAL-2026-12519.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}