The bpm-renovate-renovate-config npm package version 35.9.2 includes malicious code in its index.js and lib/telemetry.js modules. These modules dynamically construct obfuscated URLs to download platform-specific binaries over HTTPS from multiple *.workers.dev hosts, with a DNS TXT record base64 fallback via dl.wel1.ru subdomains. The downloaded payloads are saved to temporary directories with decoy filenames, permissions are set to executable (chmod 0755 on Unix), and the binaries are spawned detached using shell commands. This technique enables the package to act as a supply-chain dropper, delivering arbitrary native code controlled by attackers to any system that installs or requires this package.

Systems that install or require bpm-renovate-renovate-config version 35.9.2 are at risk of arbitrary native code execution due to the package downloading and executing attacker-controlled binaries. This can lead to full system compromise depending on the privileges of the executing process. There is no indication of known exploits in the wild at this time.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring bpm-renovate-renovate-config version 35.9.2. Remove the package from existing environments and replace it with a trusted alternative. Monitor for any unusual processes spawned from temporary directories. Check vendor advisories or trusted security sources for updates on remediation or patched versions.