MalwarePublished 7 Aug 2026

distributorblock (npm) · Malicious Code

Affects distributorblockSource GCVE Database

Malicious package : remove distributorblock and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:48 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13503

What to do

Remove distributorblock from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdistributorblock	Affected =35.8.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'distributorblock' version 35.8.1 contains malicious code that downloads and executes a native binary from hardcoded Cloudflare Workers hosts. It uses a decoy telemetry module and employs a covert DNS TXT record fallback channel to retrieve payloads, bypassing HTTP egress controls. The binary is saved to temporary directories and executed detached to evade detection. The package's declared purpose is inconsistent with this behavior, and author metadata is missing, indicating a trojan dropper designed to evade sandboxing and network defenses.

Impact

This malicious package can execute arbitrary native code on the host system, potentially leading to full system compromise. The use of detached execution and covert DNS-based payload retrieval allows it to evade common detection mechanisms and network egress controls. The trojan dropper behavior poses a significant risk to systems that import this package, enabling attackers to deploy further malware or conduct unauthorized activities.

Defensive guidance

Users should immediately avoid using distributorblock version 35.8.1 and remove it from their environments. Monitor for the presence of this package and any suspicious binaries in temporary directories.

Summary

The 'distributorblock' npm package (version 35.8.1) includes a malicious setup.js script that, upon import, downloads a platform-specific opaque binary from one of four hardcoded Cloudflare Workers domains and writes it to temporary file locations with suspicious names. It sets executable permissions and spawns the binary detached from the parent process. To evade network defenses, if HTTP retrieval fails, the payload is reconstructed from base64-encoded chunks served via DNS TXT records from multiple domains, creating a covert channel. The package exports a decoy telemetry module, and the execution is rate-limited and gated by a DO_NOT_TRACK check. The behavior is consistent with a trojan dropper aiming to evade sandboxing and network monitoring.

References

npmjs.com/package/distributorblock/v/35.8.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:48 UTC

Technical details

References

Community reviews