bnpl-api (npm) · Malicious Code
Affects bnpl-apiSource GCVE Database
Malicious package : remove bnpl-api and rotate any secrets on hosts that installed it.
Data as of 6 Aug 2026, 19:32 UTC
Malicious package
Published to npm · OSV MAL-2026-12860
What to do
Remove bnpl-api from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbnpl-api | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The bnpl-api npm package version 35.9.5 is a malicious package that executes attacker-controlled native binaries on the host system upon installation. It fetches these binaries from anonymous Cloudflare Workers or via a DNS-TXT covert channel, writes them to temporary directories, sets executable permissions, and runs them detached. The package has no legitimate functionality and is designed solely to compromise the host system.