Threats Tagged 'mal-2026-12343'
View all threats tagged with 'mal-2026-12343'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'mal-2026-12343'
Click on any threat for detailed analysis and mitigation recommendations
Malicious code in bpm-foundation-feature-flags (npm) 0 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045) On require() of bpm-foundation-feature-flags, index.js loads _init.js which downloads a platform-specific native binary from obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT fallback channel to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that reconstructs base64-encoded binary bytes from TXT records. The downloaded bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are assembled at runtime from split string fragments to evade static analysis. The behavior is framed as opt-out 'telemetry/analytics' (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK env checks and a /tmp/.analytics_state freshness marker), but the fetched payload is an opaque native executable unrelated to the declared feature-flag purpose. This yields remote code execution on the installer's host at import time. Join the discussion | GCVE Database | 08/05/2026, 12:44:58 UTC Added: 08/05/2026, 15:31:18 UTC |
Showing 1 to 1 of 1 result