Skip to content

Malicious code in bjm-low-code-components (npm)

Malware Published Aug 11, 2026 to the GitHub Advisory Database

Package

npm bjm-low-code-components (npm)

Affected versions

= 99.0.0

Patched versions

None

Description

Source: amazon-inspector (f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b)

On npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and selected environment variables and POSTs them over plain HTTP to a hardcoded Burp Collaborator OAST subdomain at 2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com/bjm-canary. This is a dependency-confusion / reconnaissance beacon: installer-side identity and environment data leave the machine automatically on install to an attacker-controlled endpoint.

Credit: OpenSSF (source)

References

Published to the GitHub Advisory Database Aug 11, 2026
Reviewed Aug 11, 2026

EPSS score

Weaknesses

Embedded Malicious Code

The product contains code that appears to be malicious in nature. Learn more on MITRE.

GHSA ID

GHSA-r8w4-qgmq-q94q

Source code

No known source code
Improvements are not currently accepted on this advisory because this package is malware and has no patched versions. If there is something to change, please open an issue at https://github.com/github/advisory-database/issues.