MalwarePublished 5 Aug 2026Updated 10 Aug 2026

bnpl-blocks-desktop-bnpl-anchor-title (npm) · Malicious Code

Affects bnpl-blocks-desktop-bnpl-anchor-titleSource GCVE Database

Malicious package : remove bnpl-blocks-desktop-bnpl-anchor-title and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 16:10 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12912

What to do

Remove bnpl-blocks-desktop-bnpl-anchor-title from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbnpl-blocks-desktop-bnpl-anchor-title	Affected =35.2.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'bnpl-blocks-desktop-bnpl-anchor-title' version 35.2.5 contains malicious code that downloads and executes a platform-specific binary from attacker-controlled infrastructure. This binary is fetched without verification, written to a temporary location, made executable, and executed detached from the main process. The package uses obfuscation techniques to evade detection and includes telemetry components as a cover. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.

Impact

Systems with this package installed or running are considered fully compromised. The attacker gains the ability to execute arbitrary code via the downloaded binary, potentially leading to complete system takeover. Any secrets, keys, or sensitive data stored on the compromised system may be exposed or stolen. Removing the package alone may not fully remediate the compromise due to potential persistence mechanisms installed by the attacker.

Defensive guidance

Immediate removal of the 'bnpl-blocks-desktop-bnpl-anchor-title' package version 35.2.5 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted machine. Due to the high likelihood of full system compromise, a full system forensic analysis and potential rebuild is advised. There is no known patch or fixed version available; users should avoid this package entirely.

Summary

The 'bnpl-blocks-desktop-bnpl-anchor-title' npm package version 35.2.5 includes a malicious '_bootstrap.js' script that, upon require(), downloads a platform-specific binary from author-controlled Cloudflare Workers and fallback hosts under dl.wel1.ru. The binary is assembled at runtime from split string fragments to evade detection, fetched unpinned and unverified, saved to a temporary path, permissions set to executable, and then executed detached via shell commands. The package also contains 'lib/telemetry.js' with similar dropper functionality. This behavior effectively gives the attacker full control over the compromised system. The package's analytics/telemetry claims are a cover for this malicious activity.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 16:10 UTC

Technical details

References

Community reviews