{"answers":{"affected":"1 open source package ship an affected version, including bnpl-blocks-types.","exploited":"There is no known exploitation of MAL-2026-13020 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13020 is a malicious package in bnpl-blocks-types, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-13020 is a malicious package: bnpl-blocks-types (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13020/ (Markdown: https://insights.sbomify.com/MAL-2026-13020/index.md)","id":"MAL-2026-13020","markdown":"https://insights.sbomify.com/MAL-2026-13020/index.md","name":"MAL-2026-13020","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require() of bnpl-blocks-types, index.js loads _helpers.js which selects a platform-specific path (/pkg/package, /pkg/package.exe, /pkg/loader_mac, /pkg/package-arm64) and downloads a binary from hostnames reconstructed at runtime via array.join to defeat static inspection: oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, and oob-worker.cf99-9b3.workers.dev. If HTTPS retrieval fails, a fallback assembles the payload from base64-encoded DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under decoy names (dotnet_diag_\u003chex\u003e.exe on Windows, hidden.cache_\u003chex\u003e on Unix), chmod 0755, and spawned detached and unref'd via cp.spawn('/bin/sh', ['-c', fp + ' \u0026'], {detached:true}). A second dropper copy is staged as lib/telemetry.js (81 KB, framed as an analytics SDK) containing the same base64-assemble, chmod 0755, and detached /bin/sh spawn pattern, with require('child_'+'process') and fs['chmod'+'Sync'] string-split obfuscation. Behavior is guarded by an mtime cache and opt-out env vars, consistent with a persistent, staged install-time dropper.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bnpl-blocks-types (npm)","id":"MAL-2026-13020","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bnpl-blocks-types","purl":"pkg:npm/bnpl-blocks-types","source":"MAL-2026-13020"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13020/"}