MalwarePublished 5 Aug 2026

bnpl-blocks-atom-bnpl-base-popup (npm) · Malicious Code

Affects bnpl-blocks-atom-bnpl-base-popupSource GCVE Database

Malicious package : remove bnpl-blocks-atom-bnpl-base-popup and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:31 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12865

What to do

Remove bnpl-blocks-atom-bnpl-base-popup from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbnpl-blocks-atom-bnpl-base-popup	Affected =35.2.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bnpl-blocks-atom-bnpl-base-popup version 35.2.9 contains malicious code that downloads and executes an opaque, author-controlled native binary on the host machine upon import. This binary is fetched from Cloudflare Workers hostnames and written to temporary directories before execution. The package also includes a secondary file mimicking telemetry functionality that performs similar malicious download and execution actions. The execution is designed to evade sandbox and researcher detection using environment checks and TTL markers. Installation or use of this package results in full compromise of the affected system.

Impact

Any system with this package installed or running is considered fully compromised. The malicious binary grants the attacker full control over the host, risking exposure of all stored secrets and keys. Immediate rotation of all credentials accessed from the compromised system is necessary. Removal of the package alone does not guarantee elimination of all malicious components or persistence mechanisms.

Defensive guidance

Remove the bnpl-blocks-atom-bnpl-base-popup package version 35.2.9 immediately from all affected systems. Rotate all secrets and keys that were stored or used on the compromised machines, performing these actions from a separate, trusted environment. Because the package executes an opaque binary that may establish persistence, conduct a thorough forensic investigation and system cleanup to ensure no residual malicious components remain.

Summary

The npm package bnpl-blocks-atom-bnpl-base-popup version 35.2.9 is malicious. Its main entry point requires a _polyfill.js script that dynamically reconstructs Cloudflare Workers hostnames to download a platform-specific native binary. This binary is saved to temporary locations with executable permissions and launched detached from the main process. A secondary file, lib/telemetry.js, duplicates this behavior under the guise of an Analytics SDK. The package uses environment variables and a TTL marker file to evade detection in sandbox or research environments. Importing this package triggers automatic download and execution of potentially harmful code, leading to full system compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:31 UTC

Technical details

References

Community reviews