Malicious code in bcore-bravo-eslint-config (npm)
The npm package bcore-bravo-eslint-config contained malicious code that, when required, downloads and executes platform-specific native binaries from Cloudflare Workers mirrors and a fallback domain. The package masquerades as an ESLint configuration module but performs arbitrary code execution at import time.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed bcore-bravo-eslint-config would execute arbitrary native code at require-time, potentially compromising build environments and downstream artifacts.
- Ecosystems
- Attack vectors
- Affected entities
- bcore-bravo-eslint-confignpm package containing malicious dropper code
The npm package bcore-bravo-eslint-config was published with embedded malicious code designed to execute arbitrary native binaries. When the package is imported via require(), it triggers a bootstrap sequence that downloads platform-specific executables (Linux x64, macOS ARM64, macOS x86, Windows) from rotating Cloudflare Workers subdomains and a dl.well1.site fallback domain.\n\nThe attack uses obfuscation techniques to hide malicious intent: destination hostnames and dangerous API calls are assembled through string-splitting and dynamic property lookup (e.g., require(\"child_\"+\"process\"), os[\"plat\"+\"form\"], fs[\"chmod\"+\"Sync\"]). The fetched binaries are base64-decoded, written to a staging path, marked executable, and executed via child_process.\n\nThe package exports a minimal 24-line ConfigLoader API unrelated to the actual payload, making it appear legitimate to casual inspection. The name suggests a typosquatting variant of a legitimate ESLint configuration package. Any developer or CI/CD pipeline that installed this package would execute arbitrary code at require-time, potentially compromising build environments and downstream software artifacts.\n\nThe incident was detected and reported via Amazon Inspector, and the package has been removed from npm.
Indicators of compromise
- Packages
- bcore-bravo-eslint-config
- Domains
- dl.well1.site
Remediation
- Immediately remove bcore-bravo-eslint-config from all package.json files and lock files
- Audit npm install logs and CI/CD build logs for any execution of this package
- Assume any build environment that installed this package is compromised; rotate credentials and secrets used in those environments
- Scan systems that ran builds with this package for unexpected network connections to Cloudflare Workers subdomains or dl.well1.site
- Review and re-sign any artifacts built with this package present in the dependency tree
- Use npm audit and supply chain security tools to detect similar typosquatting and dropper patterns
Sources
- GitHub Advisory GHSA-rp5f-362v-pw3h · GitHub Advisory Database
Cite this entry
"Malicious code in bcore-bravo-eslint-config (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-bcore-bravo-eslint-config-npm-1yblwg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in dolyame-ui-postcsscustomproperties (npm)
The npm package dolyame-ui-postcsscustomproperties contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers and DNS infrastructure. The package typosquats the legitimate postcss-custom-properties package and disguises the malicious payload as an analytics/telemetry module.
npmCompromised packageTyposquatting - containedcritical
Malicious code in base-ui-cli (npm)
The npm package base-ui-cli contains malicious code that makes unauthorized fetch() calls to an attacker-controlled Cloudflare Workers endpoint (base-ui-pro-registry.l-dimitrov.workers.dev) in addition to the legitimate npm registry. The package name appears designed to impersonate the unrelated Base UI component library, suggesting a typosquatting attack.
npmCompromised packageTyposquatting - activecritical
Malicious code in hardhat-set (npm)
The npm package hardhat-set contains malicious obfuscated code disguised with a copied pino logger README. The package executes a multi-megabyte obfuscated payload on import, delivering hidden malware to anyone who installs or requires it.
npmTyposquattingCompromised package