MalwarePublished 7 Aug 2026

ded-pwa-bnpl-forms-test-demo (npm) · Malicious Code

Affects ded-pwa-bnpl-forms-test-demoSource GCVE Database

Malicious package : remove ded-pwa-bnpl-forms-test-demo and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13532

What to do

Remove ded-pwa-bnpl-forms-test-demo from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmded-pwa-bnpl-forms-test-demo	Affected =35.7.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package ded-pwa-bnpl-forms-test-demo version 35.7.8 contains malicious code that downloads and executes attacker-controlled native binaries during import. The package's index.js loads a helper script that fetches platform-specific payloads from attacker-controlled Cloudflare Workers endpoints and a fallback DNS-TXT domain. The downloaded binaries are saved to temporary directories with disguised filenames, made executable, and launched detached without any integrity verification. This behavior occurs immediately upon requiring the package, enabling remote code execution on the host system. There is no official patch or remediation guidance available.

Impact

This malicious package enables remote code execution on any system that installs and requires it, allowing attackers to run arbitrary native code with the privileges of the user executing the package. The lack of integrity checks and use of attacker-controlled download endpoints increases the risk of persistent compromise. Because the malicious code executes immediately upon import, any dependent project or user is at risk of infection. No known exploits in the wild are reported yet, but the potential impact is severe.

Defensive guidance

Until an official fix or removal is available, avoid installing or requiring the ded-pwa-bnpl-forms-test-demo package version 35.7.8. Monitor dependency trees for this package and remove it if found. Consider using package integrity verification tools and restrict network access to untrusted domains to reduce risk.

Summary

The ded-pwa-bnpl-forms-test-demo npm package at version 35.7.8 includes a malicious dropper embedded in its main entry point. Upon require(), index.js loads _helpers.js which dynamically constructs domain names to evade detection and downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints and a DNS-TXT fallback domain. The binary is saved to a temporary file with a disguised name, permissions are set to executable, and it is spawned detached via shell commands without any hash or signature verification. The opt-out mechanism is hidden behind a generic DISABLE_TELEMETRY environment variable, making it unlikely to be disabled by default. This results in arbitrary native code execution on the host system during normal package usage.

References

npmjs.com/package/ded-pwa-bnpl-forms-test-demo/v/35.7.8 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:29 UTC

Technical details

References

Community reviews