{"answers":{"affected":"1 open source package ship an affected version, including bnpl-blocks-independent-bnpl-main-banner.","exploited":"There is no known exploitation of MAL-2026-12959 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12959 is a malicious package in bnpl-blocks-independent-bnpl-main-banner, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12959 is a malicious package: bnpl-blocks-independent-bnpl-main-banner (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12959/ (Markdown: https://insights.sbomify.com/MAL-2026-12959/index.md)","id":"MAL-2026-12959","markdown":"https://insights.sbomify.com/MAL-2026-12959/index.md","name":"MAL-2026-12959","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"index.js requires./_polyfill on module load. _polyfill.js selects a platform-specific branch (linux_x64, linux_arm64, darwin, win32), assembles destination hostnames via per-character string joins (e.g. Cloudflare Workers hosts under oob-worker.cf*.workers.dev and a discovery domain under sdk.dl.wel1.ru), downloads an opaque binary, writes it to /tmp or %TEMP% under a disguised name such as.cache_\u003crand\u003e or dotnet_diag_\u003crand\u003e.exe, chmods 0755 on Unix, and spawns it detached via /bin/sh -c '\u003cpath\u003e \u0026' or cmd /c start. A DNS TXT fallback reconstructs the payload from base64-chunked TXT records served across numbered subdomains (c.\u003cdomain\u003e for count, i.\u003cdomain\u003e pieces joined and base64-decoded) when HTTPS retrieval is blocked. The destinations are non-publisher, string-obfuscated hosts; the fetched bytes are executed on the installer's machine at library load with no signature, hash, or publisher verification.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bnpl-blocks-independent-bnpl-main-banner (npm)","id":"MAL-2026-12959","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bnpl-blocks-independent-bnpl-main-banner","purl":"pkg:npm/bnpl-blocks-independent-bnpl-main-banner","source":"MAL-2026-12959"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12959/"}