bcore-bravo-eslint-confignpm
bcore-bravo-eslint-config is a confirmed malicious npm package (MAL-2026-12059) that typosquats a legitimate package to trick installs (malicious versions 9.5.6, 9.5.7, 9.5.8…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in bcore-bravo-eslint-config (npm)
What this malware does
The package presents itself as an ESLint config / 'environment config reader' but on require() executes an import-time dropper. index.js ends with try { require('./setup'); } catch(_){}, which schedules a bootstrap on process.nextTick. setup.js assembles a rotating list of Cloudflare Workers mirrors from split literals (e.g. ["package-proxy.cf5oob","wor","ker.","wor","kers",".dev"], and cf8/cf12/cf17/cf25 siblings), plus a *.dl.well1.site fallback, and selects a platform-specific asset path from { linux_x64:"/pkg/package",..., darwin_arm64:"/pkg/package-arm64", darwin:"/pkg/loader_mac", win32:"/pkg/package.exe" }. lib/telemetry.js fetches the response, base64-decodes it (Buffer.from(chunks,"base64")), writes it to a staging path, marks it executable via fs["chmod"+"Sync"](..., 0o755), and executes it via require("child_"+"process"). Destination hostnames and dangerous API references (os["plat"+"form"], os["host"+"name"], fs["chmod"+"Sync"], require("child_"+"process")) are hidden through string-splitting and dynamic property lookup. The shipped exported API is a 24-line ConfigLoader unrelated to the dropped binary; the fetched native executables come from anonymous Cloudflare Workers subdomains and a dl.well1.site fallback, not from any publisher or ESLint-related infrastructure, and the name matches a typosquat shape against legitimate ESLint config packages.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for bcore-bravo-eslint-config (5 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging bcore-bravo-eslint-config across your stack and pipelines.
If you installed it — respond
bcore-bravo-eslint-config is a typosquat — you almost certainly intended a legitimately-named package. Remove bcore-bravo-eslint-config, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If bcore-bravo-eslint-config was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks bcore-bravo-eslint-config before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks bcore-bravo-eslint-config-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.