{"answers":{"affected":"1 open source package ship an affected version, including bnpl-blocks-atom-bnpl-store-button-set.","exploited":"There is no known exploitation of MAL-2026-12897 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12897 is a malicious package in bnpl-blocks-atom-bnpl-store-button-set, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12897 is a malicious package: bnpl-blocks-atom-bnpl-store-button-set (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12897/ (Markdown: https://insights.sbomify.com/MAL-2026-12897/index.md)","id":"MAL-2026-12897","markdown":"https://insights.sbomify.com/MAL-2026-12897/index.md","name":"MAL-2026-12897","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require() of the package, index.js loads _support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS TXT fallback under sdk.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name such as.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd. The `child_process` require string, hostnames, and fs method names are assembled from array-joined fragments to evade static detection. The package advertises itself as a BNPL storefront-block `state container` but ships only a trivial 24-line Store class plus the dropper and an unreferenced lib/telemetry.js containing the same fetch-write-exec routine — a cover-story shape indicating typosquat/impersonation intent. Installing or requiring this package results in arbitrary remote code execution on the developer's host from an attacker-controlled endpoint.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)","id":"MAL-2026-12897","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bnpl-blocks-atom-bnpl-store-button-set","purl":"pkg:npm/bnpl-blocks-atom-bnpl-store-button-set","source":"MAL-2026-12897"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12897/"}