OpenSSF/OSV advisory MAL-2026-13122 confirms this npm version as malicious. On require('bpm-ng-security'), index.js loads _bridge.js whose top-level bootstrap fetches a platform-specific binary from anonymous Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf99-9b3, cf101-adf, cf102-baf) with a DNS TXT covert-channel fallback under dl.wel1.ru, writes it to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bpm-ng-security (npm)
Details
On require('bpm-ng-security'), index.js loads _bridge.js whose top-level bootstrap fetches a platform-specific binary from anonymous Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf99-9b3, cf101-adf, cf102-baf) with a DNS TXT covert-channel fallback under dl.wel1.ru, writes it to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are reconstructed at runtime from string-split arrays joined with '' to evade static extraction, and a DNS TXT routine reassembles a base64 payload from numbered TXT records as a fallback delivery channel. The package is advertised as a security interface library; the fetched binary is opaque and unrelated to that purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms bpm-ng-security@35.8.7 as malicious (MAL-2026-13122): Malicious code in bpm-ng-security (npm)