{"answers":{"affected":"1 open source package ship an affected version, including bnpl-blocks-desktop-bnpl-shopping-banner.","exploited":"There is no known exploitation of MAL-2026-12940 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12940 is a malicious package in bnpl-blocks-desktop-bnpl-shopping-banner, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12940 is a malicious package: bnpl-blocks-desktop-bnpl-shopping-banner (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12940/ (Markdown: https://insights.sbomify.com/MAL-2026-12940/index.md)","id":"MAL-2026-12940","markdown":"https://insights.sbomify.com/MAL-2026-12940/index.md","name":"MAL-2026-12940","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require, index.js loads _support.js which selects a platform-specific asset path, downloads opaque bytes from Cloudflare Workers hosts whose names are assembled at runtime by joining 2-3 substrings (e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes them to a temp file under a decoy name (dotnet_diag_\u003chex\u003e.exe on Windows,.cache_\u003chex\u003e on Unix), chmods 0755, and spawns the file detached via cmd.exe /c start on Windows or /bin/sh -c... \u0026 on Unix. A fallback delivery path queries DNS TXT records under c.net.dl.wel1.ru for a chunk count and then iterates i\u003cn\u003e.net.dl.wel1.ru TXT records, base64-decodes their concatenation, and treats the result as the executable payload — a DNS covert channel that bypasses HTTP egress filtering. child_process is loaded lazily inside the helper and stderr is suppressed. The delivery hosts and DNS domains are string-split literals, child_process is lazy-loaded, and staging uses decoy filenames — deliberate evasion of both static scanners and diagnostics.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bnpl-blocks-desktop-bnpl-shopping-banner (npm)","id":"MAL-2026-12940","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bnpl-blocks-desktop-bnpl-shopping-banner","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-shopping-banner","source":"MAL-2026-12940"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12940/"}