{"id":"MAL-2026-13113","summary":"Malicious code in bpm-foundation-nest-keycloak-connect (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955)\nOn require() of the package, index.js loads _shim.js which detects OS and architecture, then downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled by string-array join to evade static scans (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT fallback channel over *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag_*,.cache_*), chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref() (or cmd on Windows). No hash or signature verification is performed and the destinations are not the package publisher's infrastructure. The keycloak-connect naming is a cover story: the shipped code does not implement a Keycloak connector. An additional ~81KB lib/telemetry.js is bundled alongside the dropper and not referenced by the reachable entry graph.\n","modified":"2026-08-05T15:52:29.628627476Z","published":"2026-08-05T14:20:38Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["35.8.6"],"id":"IN-MAL-2026-015264","import_time":"2026-08-05T15:19:41.40763489Z","modified_time":"2026-08-05T14:20:38Z","sha256":"6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bpm-foundation-nest-keycloak-connect/v/35.8.6"}],"affected":[{"package":{"name":"bpm-foundation-nest-keycloak-connect","ecosystem":"npm","purl":"pkg:npm/bpm-foundation-nest-keycloak-connect"},"versions":["35.8.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bpm-foundation-nest-keycloak-connect/MAL-2026-13113.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"556616a341ea5fe9635c03d88aa325b8248959fbca909ba273c46b84b245ca49","tlsh":"0ca1635a126630188bb0ebe4c71b4419f65af66327819295fb5c68985fb3128c3b1efc"},{"path":"lib/telemetry.js","sha256":"a56fea255feff09fc359066fdd8f5e63262025dbd3c21b30c09d3f2b891256f9","tlsh":"06835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bpm-foundation-nest-keycloak-connect-35.8.6.tgz","hashes":{"sha1":"bfa59176baf35981eff760503ce7ea39337492b9","sha512_sri":"sha512-MdvmUmVZ4LHceKrIMjU9yP7G1n6lw8nmduH+1ucDPHMFsAnaVOylV/pEVTsn76zdc3kmI8EyrtTzSqiEhj0lLA=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}