MalwarePublished 5 Aug 2026

bnpl-blocks-atom-bnpl-dropdown (npm) · Malicious Code

Affects bnpl-blocks-atom-bnpl-dropdownSource GCVE Database

Malicious package : remove bnpl-blocks-atom-bnpl-dropdown and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:30 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12872

What to do

Remove bnpl-blocks-atom-bnpl-dropdown from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbnpl-blocks-atom-bnpl-dropdown	Affected =35.5.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bnpl-blocks-atom-bnpl-dropdown version 35.5.5 contains malicious code that executes arbitrary code on the host system upon installation or require. It downloads and executes opaque binaries from attacker-controlled infrastructure across Linux, macOS, and Windows platforms. This results in full host compromise, potentially exposing all stored secrets and keys.

Impact

Any system with this package installed or running is considered fully compromised. The attacker gains full code execution capabilities, potentially accessing or exfiltrating all secrets and keys stored on the system. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Defensive guidance

Immediate removal of the bnpl-blocks-atom-bnpl-dropdown package version 35.5.5 is recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted environment. Due to the full host compromise risk, a full system audit and potential rebuild may be necessary.

Summary

The malicious code in bnpl-blocks-atom-bnpl-dropdown (version 35.5.5) unconditionally requires a support module that reconstructs Cloudflare Workers hostnames and DNS domains from obfuscated string literals. It fetches an opaque binary via HTTPS, writes it to temporary files with misleading names, sets executable permissions, and spawns the binary detached using platform-specific shell commands. The package also uses obfuscation techniques such as dynamic module name concatenation to evade static detection. Environment variables and marker files are used to disguise the dropper's activity. Installing or requiring this package results in full code execution from untrusted, attacker-controlled infrastructure, compromising the host system.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:30 UTC

Technical details

References

Community reviews