# MAL-2026-12897: Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)


- **Type:** Malicious package
- **Package:** `bnpl-blocks-atom-bnpl-store-button-set` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12897?

MAL-2026-12897 is a malicious package in bnpl-blocks-atom-bnpl-store-button-set, published on 5 Aug 2026. 

### Official description

On require() of the package, index.js loads _support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS TXT fallback under sdk.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods 0755, and spawns it detached via /bin/sh -c or cmd. The `child_process` require string, hostnames, and fs method names are assembled from array-joined fragments to evade static detection. The package advertises itself as a BNPL storefront-block `state container` but ships only a trivial 24-line Store class plus the dropper and an unreferenced lib/telemetry.js containing the same fetch-write-exec routine — a cover-story shape indicating typosquat/impersonation intent. Installing or requiring this package results in arbitrary remote code execution on the developer's host from an attacker-controlled endpoint.

## What should I do about MAL-2026-12897?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12897 is a malicious package: bnpl-blocks-atom-bnpl-store-button-set (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12897/ (Markdown: https://insights.sbomify.com/MAL-2026-12897/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12897

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12897/
Summaries are generated and may contain mistakes; the official description above is the record.