MalwarePublished 5 Aug 2026Updated 20 Aug 2026

pfp-block-mobile-steps (npm) · Malicious Code

Affects pfp-block-mobile-stepsSource GCVE Database

Malicious package : remove pfp-block-mobile-steps and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12410

What to do

Remove pfp-block-mobile-steps from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpfp-block-mobile-steps	Affected =20.9.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'pfp-block-mobile-steps' version 20.9.3 contains malicious code that downloads and executes opaque binaries from hardcoded Cloudflare Workers hosts or via DNS TXT record lookups. The payload is written to temporary files with stealthy names and executed without verification, exhibiting anti-analysis behavior. This activity is unrelated to the package's stated purpose and poses a risk of arbitrary code execution on affected systems.

Impact

This malicious package can lead to arbitrary code execution on systems that install and run version 20.9.3 of 'pfp-block-mobile-steps'. The downloaded payload is opaque and executed without verification, potentially allowing attackers to run any code with the privileges of the user running the package. The stealthy execution and anti-analysis features increase the risk of undetected compromise.

Defensive guidance

Users should immediately avoid using version 20.9.3 of 'pfp-block-mobile-steps' and remove it from their environments. Check vendor or repository advisories for updates or official guidance.

Summary

The 'pfp-block-mobile-steps' npm package version 20.9.3 includes malicious functionality in its index.js that unconditionally loads a shim script. This shim selects a payload path based on the platform and architecture, then downloads an opaque binary executable from one of four hardcoded Cloudflare Workers endpoints. To evade static detection, the hostnames are assembled at runtime from string fragments. If HTTPS retrieval fails, the payload is alternatively fetched out-of-band via DNS TXT record lookups from *.dl.well1.site domains, reconstructing the payload from multiple TXT records. The binary is saved to a temporary file with stealth filenames (e.g., dotnet_diag_*.exe, .cache_*), permissions set to executable on Unix, and launched detached with silenced stderr. No integrity checks such as hash or signature verification are performed. Execution is controlled by a run-once flag and opt-out environment variables, consistent with anti-analysis techniques. This behavior is unrelated to any legitimate platform adapter functionality and indicates malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:51 UTC

Technical details

References

Community reviews