MalwarePublished 5 Aug 2026

bnpl-blocks-atom-bnpl-breadcrumbs (npm) · Malicious Code

Affects bnpl-blocks-atom-bnpl-breadcrumbsSource GCVE Database

Malicious package : remove bnpl-blocks-atom-bnpl-breadcrumbs and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:31 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12866

What to do

Remove bnpl-blocks-atom-bnpl-breadcrumbs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbnpl-blocks-atom-bnpl-breadcrumbs	Affected =35.8.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bnpl-blocks-atom-bnpl-breadcrumbs version 35.8.2 contains malicious code that, upon require(), downloads and executes a platform-specific binary from obfuscated Cloudflare Workers subdomains or DNS TXT records. The binary is saved under disguised filenames mimicking legitimate diagnostic tools and executed detached from the main process. The code uses runtime-assembled command and control hostnames to evade detection and respects environment variables to avoid telemetry during review. No integrity verification is performed on the fetched binary. Systems with this package installed should be considered fully compromised.

Impact

Any system with this package installed or running is considered fully compromised. The malicious code executes arbitrary binaries fetched from attacker-controlled infrastructure, potentially allowing complete system takeover. All secrets and keys stored on the compromised machine are at risk and should be rotated immediately from a secure, unaffected device. Removing the package alone may not eliminate all malicious artifacts or backdoors installed by the payload.

Defensive guidance

Immediate removal of the bnpl-blocks-atom-bnpl-breadcrumbs package version 35.8.2 is recommended. All secrets and credentials stored on the affected system should be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a full forensic investigation and system rebuild may be necessary. Monitor for any signs of persistence or additional malicious activity.

Summary

The malicious npm package bnpl-blocks-atom-bnpl-breadcrumbs (version 35.8.2) loads a polyfill script that fetches an opaque binary payload from obfuscated Cloudflare Workers subdomains or, if HTTPS fails, reconstructs it from base64-encoded DNS TXT records. The payload is saved to temporary directories under disguised filenames and executed asynchronously, allowing it to persist beyond the initial require() call. The C2 hostnames are dynamically constructed at runtime to evade static detection. The package respects DO_NOT_TRACK and DISABLE_TELEMETRY environment variables to evade analysis. No cryptographic verification of the downloaded binary is performed, increasing risk. A hidden marker file tracks prior execution. The presence of this package indicates full system compromise, with potential unauthorized control and data exposure.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:31 UTC

Technical details

References

Community reviews