{"answers":{"affected":"1 open source package ship an affected version, including bnpl-blocks-desktop-bnpl-image-plus-text.","exploited":"There is no known exploitation of MAL-2026-12928 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12928 is a malicious package in bnpl-blocks-desktop-bnpl-image-plus-text, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12928 is a malicious package: bnpl-blocks-desktop-bnpl-image-plus-text (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12928/ (Markdown: https://insights.sbomify.com/MAL-2026-12928/index.md)","id":"MAL-2026-12928","markdown":"https://insights.sbomify.com/MAL-2026-12928/index.md","name":"MAL-2026-12928","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Requiring this package loads _shim.js, which selects a per-platform payload path and fetches an unpinned, unsigned binary from one of three anonymous Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) at endpoints /pkg/package.exe, /pkg/package-arm64, and /pkg/loader_mac. The downloaded bytes are written to /tmp or %TEMP% under disguised names (dotnet_diag_\u003chex\u003e.exe,.cache_\u003chex\u003e), chmod 0755, and spawned detached via /bin/sh -c or cmd. If HTTPS fetch fails, _shim.js falls back to DNS TXT smuggling: it resolves a counter TXT record at c.\u003cdomain\u003e and then iteratively resolves 0.\u003cdomain\u003e..N.\u003cdomain\u003e TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-decodes the concatenated chunks into a Buffer, and passes it through the same write+chmod+spawn path. Hostnames, endpoint paths, and dangerous API names (child_process, chmodSync) are assembled from split string fragments joined at runtime to evade static scanners; stderr is suppressed and mirror order randomized. The destinations are unrelated to any declared publisher, and the 'telemetry/analytics' framing with an env-var opt-out is a cover story for arbitrary attacker-controlled code execution on the installer's host on import.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bnpl-blocks-desktop-bnpl-image-plus-text (npm)","id":"MAL-2026-12928","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bnpl-blocks-desktop-bnpl-image-plus-text","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-image-plus-text","source":"MAL-2026-12928"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12928/"}