Malicious code in bjm-low-code-components (npm)
The npm package bjm-low-code-components contained malicious code in its postinstall hook that exfiltrated installer environment data (hostname, username, working directory, environment variables) to an attacker-controlled OAST endpoint. This reconnaissance beacon was designed to collect information about systems installing the package.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed bjm-low-code-components during the malicious period
- Ecosystems
- Attack vectors
- Affected entities
- bjm-low-code-componentsnpm package containing malicious postinstall hook
The npm package bjm-low-code-components was found to contain malicious code in its postinstall hook. Upon installation, the package executes a canary.js script that automatically collects sensitive installer environment information.
The malicious script gathers the installer's hostname, username, current working directory, and selected environment variables. This data is then exfiltrated via an unencrypted HTTP POST request to a hardcoded Burp Collaborator OAST subdomain at 2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com/bjm-canary.
This attack represents a reconnaissance beacon and dependency-confusion vector, allowing the attacker to automatically collect identity and environment data from any system installing the compromised package without user awareness or consent.
The incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13751).
Indicators of compromise
- Packages
- bjm-low-code-components
- Domains
- 2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com
Remediation
- Immediately uninstall bjm-low-code-components from all systems
- Review npm audit logs and package-lock.json files to identify all installations of bjm-low-code-components
- Assume any system that installed this package may have had environment data exfiltrated; review access logs and environment variables for sensitive data exposure
- Update npm dependencies to remove bjm-low-code-components and use legitimate alternatives
- Monitor for suspicious outbound HTTP connections to the OAST domain from affected systems
- Consider rotating credentials and secrets that may have been present in environment variables on affected systems
Sources
- GitHub Advisory GHSA-r8w4-qgmq-q94q · GitHub Advisory Database
Cite this entry
"Malicious code in bjm-low-code-components (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 11, 2026; last updated August 11, 2026. https://supplychainattack.org/incident/malicious-code-in-bjm-low-code-components-npm-1bh8ud
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit