{"id":"MAL-2026-13751","summary":"Malicious code in bjm-low-code-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b)\nOn npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and selected environment variables and POSTs them over plain HTTP to a hardcoded Burp Collaborator OAST subdomain at 2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com/bjm-canary. This is a dependency-confusion / reconnaissance beacon: installer-side identity and environment data leave the machine automatically on install to an attacker-controlled endpoint.\n","modified":"2026-08-11T19:00:11.517556714Z","published":"2026-08-11T18:50:26Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017388","import_time":"2026-08-11T18:52:01.587319807Z","modified_time":"2026-08-11T18:50:26Z","sha256":"f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b","source":"amazon-inspector","versions":["99.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bjm-low-code-components/v/99.0.0"}],"affected":[{"package":{"name":"bjm-low-code-components","ecosystem":"npm","purl":"pkg:npm/bjm-low-code-components"},"versions":["99.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"bjm-low-code-components-99.0.0.tgz","hashes":{"sha512_sri":"sha512-B3/ImHC3vuUrPZBsWn+m7JNmnsmZA9voWtt5E82n8Q5kTkoBN/mio6RLPlhBU0CsKkkxNoIBQ/aIi0aOIKoUAg==","sha1":"8ecff517a69ae92886b74bc005a6b7edb36911e1"}}],"evidence_files":[{"sha256":"d713540d01803126445afaf551daf616d1a6b892a954cb22479f429ce2b8a3ac","tlsh":"f4f0c0e642d4a9650ff8d194f0d4400816b2e14473079490e1bd600a2f9c3b82633dd9","path":"canary.js"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bjm-low-code-components/MAL-2026-13751.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}