Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

bpm-foundation-base-configsnpm

bpm-foundation-base-configs is a confirmed malicious npm package (MAL-2026-13105) that opens a backdoor for remote access (malicious version 35.6.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in bpm-foundation-base-configs (npm)

MAL-2026-13105
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall bpm-foundation-base-configs

What this malware does

On require, index.js loads _helpers.js, which reconstructs C2 hostnames via string-split-join concatenation (['oob-w','orker.cf101-adf.worke','rs','.d','ev'].join('') and similar), selects a platform-specific payload, fetches an opaque binary from those hidden hosts over HTTPS, writes it to /tmp or the Windows temp directory under a disguised filename (dotnet_diag_*.exe / .cache_*), chmods it 0755, and spawns it detached via /bin/sh or cmd.exe (_helpers.js line 125+). If HTTPS retrieval fails, loadViaDns falls back to a DNS-TXT covert channel: it queries c.<domain> for a chunk count then walks 0.<domain>..N.<domain> TXT records (resolver domain reconstructed as ['sdk.dl.we','l1.r','u'].join('')), concatenates the values, base64-decodes them into the executable buffer, and executes through the same write+chmod+spawn sink. No hash or signature verification is performed and the destination hosts have no relationship to the declared package purpose. The behavior fires purely from require() of the package.

Malicious versions

1 flagged
35.6.2

Indicators of compromise (SHA-256)

d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293

Detection & response playbook

Backdoor / remote access

  1. Find it

    Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for bpm-foundation-base-configs (version 35.6.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging bpm-foundation-base-configs across your stack and pipelines.

  2. If you installed it — respond

    bpm-foundation-base-configs establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

  3. Did it already run?

    If bpm-foundation-base-configs was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

  4. How O3 protects you

    O3 blocks bpm-foundation-base-configs before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. bpm-foundation-base-configs on npm has been identified as a malicious package (version 35.6.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-015282

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks bpm-foundation-base-configs-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
bpm-foundation-base-configs (npm) malicious package — MAL-2026-13105 | O3 Security