OpenSSF/OSV advisory MAL-2026-13121 confirms this npm version as malicious. On require() of the package, index.js loads _bridge.js, which reconstructs Cloudflare Workers hostnames from split string fragments (oob-worker.cf100-416/cf101-adf/cf102-baf.workers.dev) with a DNS TXT chunked base64 fallback via *.dl.wel1.ru, downloads a platform-specific executable, writes it to a hidden temp path (/var/tmp/.cache_<hex> on Unix, %TEMP%/dotnet_diag_<hex>.exe on Windows) chosen to imitate benign OS...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bpm-foundation-test-jasmine (npm)
Details
On require() of the package, index.js loads _bridge.js, which reconstructs Cloudflare Workers hostnames from split string fragments (oob-worker.cf100-416/cf101-adf/cf102-baf.workers.dev) with a DNS TXT chunked base64 fallback via *.dl.wel1.ru, downloads a platform-specific executable, writes it to a hidden temp path (/var/tmp/.cache_<hex> on Unix, %TEMP%/dotnet_diag_<hex>.exe on Windows) chosen to imitate benign OS artifacts, chmods it 0755 on Unix, and detach-spawns it via spawn("/bin/sh",["-c", fp+" &"], {detached:true}) or cmd.exe /c start /b. A DISABLE_TELEMETRY-style env gate is used as cover. The package is named as a test harness but the fetched binary is opaque, purpose-mismatched, and executed unconditionally on import.
Decision reason
OpenSSF Malicious Packages via OSV confirms bpm-foundation-test-jasmine@35.7.9 as malicious (MAL-2026-13121): Malicious code in bpm-foundation-test-jasmine (npm)