MalwarePublished 5 Aug 2026

bpm-foundation-feature-flags (npm) · Malicious Code

Affects bpm-foundation-feature-flagsSource GCVE Database

Malicious package : remove bpm-foundation-feature-flags and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 18:46 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12343

What to do

Remove bpm-foundation-feature-flags from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbpm-foundation-feature-flags	Affected =20.4.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045) On require() of bpm-foundation-feature-flags, index.js loads _init.js which downloads a platform-specific native binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback channel to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that reconstructs base64-encoded binary bytes from TXT records. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are assembled at runtime from split string fragments to evade static analysis. The behavior is framed as opt-out 'telemetry/analytics' (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK env checks and a /tmp/.analytics_state freshness marker), but the fetched payload is an opaque native executable unrelated to the declared feature-flag purpose. This yields remote code execution on the installer's host at import time.

Impact

Systems that install and run bpm-foundation-feature-flags version 20.4.2 risk executing an unverified, potentially malicious binary fetched from attacker-controlled infrastructure. This can lead to unauthorized code execution on affected hosts, potentially compromising system integrity and confidentiality. The malicious binary masquerades as a Microsoft diagnostic tool and is executed with minimal user visibility, increasing the risk of stealthy compromise.

Defensive guidance

Users should immediately cease using bpm-foundation-feature-flags version 20.4.2 and remove it from their environments. Investigate and audit systems for signs of compromise related to this package. Monitor for updates or advisories from the package maintainers or npm registry regarding this incident. Avoid installing packages from untrusted sources and verify package integrity before use.

Summary

The bpm-foundation-feature-flags npm package version 20.4.2 includes a malicious bootstrap routine triggered on require. It fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints, writing it to temporary locations on the host system and executing it detached via shell commands. To evade static analysis, hostnames are dynamically constructed from split string fragments. If HTTPS fetching fails, the payload is reconstructed from base64 chunks served via DNS TXT records under sequentially named subdomains. No signature or hash verification is performed on the fetched binary, which is unrelated to the package's declared purpose of feature flags management. This behavior indicates a supply chain attack embedding malicious code within a legitimate npm package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:29 UTC

Technical details

References

Community reviews