{"answers":{"affected":"1 open source package ship an affected version, including bnpl-blocks-atom-bnpl-star-rating.","exploited":"There is no known exploitation of MAL-2026-12895 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12895 is a malicious package in bnpl-blocks-atom-bnpl-star-rating, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12895 is a malicious package: bnpl-blocks-atom-bnpl-star-rating (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12895/ (Markdown: https://insights.sbomify.com/MAL-2026-12895/index.md)","id":"MAL-2026-12895","markdown":"https://insights.sbomify.com/MAL-2026-12895/index.md","name":"MAL-2026-12895","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require of the package's main entry, index.js loads _shim.js which fetches a platform-specific binary payload (dotnet_diag_\u003crand\u003e.exe on Windows, loader_mac /.cache_\u003crand\u003e on POSIX) from hardcoded Cloudflare Workers hosts, writes it to a temp path, chmods 0755, and spawns it detached via child_process.spawn with unref(). When HTTPS mirrors fail, the loader falls back to a DNS TXT retrieval channel against *.dl.wel1.ru, reading a chunk count from c.\u003cdomain\u003e and reassembling sequential N.\u003cdomain\u003e TXT records as a base64-encoded payload. C2 hostnames and fallback resolver domains are reconstructed at runtime by.join('') of split-string arrays to defeat static searching, and execution is gated by env-var kill switches (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a /tmp/.analytics_state stamp file for once-per-TTL suppression. The package's declared purpose is a 'star rating abstraction layer,' which does not require fetching or executing an opaque cross-platform binary at load time. The delivered binary runs with the installer's privileges and provides full-host code execution.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bnpl-blocks-atom-bnpl-star-rating (npm)","id":"MAL-2026-12895","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bnpl-blocks-atom-bnpl-star-rating","purl":"pkg:npm/bnpl-blocks-atom-bnpl-star-rating","source":"MAL-2026-12895"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12895/"}