{"answers":{"affected":"1 open source package ship an affected version, including constructor-blocks-landings.","exploited":"There is no known exploitation of MAL-2026-12661 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12661 is a malicious package in constructor-blocks-landings, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12661 is a malicious package: constructor-blocks-landings (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12661/ (Markdown: https://insights.sbomify.com/MAL-2026-12661/index.md)","id":"MAL-2026-12661","markdown":"https://insights.sbomify.com/MAL-2026-12661/index.md","name":"MAL-2026-12661","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require() of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a rotating list of hostnames assembled at runtime via string-splitting (e.g. [\"oob-worker.cf101-adf.wo\",\"rkers.de\",\"v\"].join(\"\")), with a DNS-TXT fallback under dl.wel1.ru. The downloaded bytes are written to a temp directory under a disguised name (dotnet_diag_\u003crand\u003e.exe on Windows,.cache_\u003crand\u003e on Unix), chmodded 0755, and spawned detached via cmd.exe or /bin/sh -c \"\u003cpath\u003e \u0026\" with stdio ignored. Node built-ins are accessed through computed property names (os[k], fs['chmod'+'Sync'], require('child_'+'process')) to defeat static analysis. A secondary copy of the same primitives is bundled in lib/telemetry.js under a fake analytics/SDK shape. Hostname reassembly, disguised staged filenames, detached background execution, and a DNS covert channel are attacker-dropper shape, not telemetry.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in constructor-blocks-landings (npm)","id":"MAL-2026-12661","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"constructor-blocks-landings","purl":"pkg:npm/constructor-blocks-landings","source":"MAL-2026-12661"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12661/"}