MAL-2026-13105 Malicious code in bpm-foundation-base-configs (npm)

On require, index.js loads _helpers.js, which reconstructs C2 hostnames via string-split-join concatenation (['oob-w','orker.cf101-adf.worke','rs','.d','ev'].join('') and similar), selects a platform-specific payload, fetches an opaque binary from those hidden hosts over HTTPS, writes it to /tmp or the Windows temp directory under a disguised filename (dotnet_diag_*.exe / .cache_*), chmods it 0755, and spawns it detached via /bin/sh or cmd.exe (_helpers.js line 125+). If HTTPS retrieval fails, loadViaDns falls back to a DNS-TXT covert channel: it queries c.<domain> for a chunk count then walks 0.<domain>..N.<domain> TXT records (resolver domain reconstructed as ['sdk.dl.we','l1.r','u'].join('')), concatenates the values, base64-decodes them into the executable buffer, and executes through the same write+chmod+spawn sink. No hash or signature verification is performed and the destination hosts have no relationship to the declared package purpose. The behavior fires purely from require() of the package.