Malicious code in @baanx/blockchain-config (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d) The package runs a bootstrap from both its install lifecycle script (`node index.js`) and its main module that invokes an obfuscated probe. The probe reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, concatenates them with a static tag (`bxcfg`) and a timestamp, and performs a `dns.resolve4` lookup against `.....oob.algamil7x.xyz`, exfiltrating installer identity over DNS to a non-first-party domain unrelated to the claimed baanx publisher. The exfil host and the `os`/`dns`/`userInfo`/`hostname`/`cwd`/`resolve4` API references are hidden in `String.fromCharCode`/hex-decoded byte arrays in `probe/impl.js` and sibling files `e9c3a6.js` / `f0d4b7.js`, and the `os` and `dns` modules are loaded through `module.constructor._load` with decoded name arrays to defeat static analysis. Behavior fires automatically on `npm install` and on `require('@baanx/blockchain-config')`. ## Source: ghsa-malware (6efa71410686d3ace79a501e2afa27505312aab915fb79429b312f9456d272b0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removi
MAL-2026-16352
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16352
@baanx/blockchain-config
Source reference: /affected/0/package/name
- Affected versions
- 9.9.11
Source reference:
/affected/0/versions9.9.9Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@baanx/blockchain-config",
"purl": "pkg:npm/%40baanx/blockchain-config",
"ecosystem": "npm"
},
"versions": [
"9.9.11",
"9.9.9"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/blockchain-config/MAL-2026-16352.json",
"indicators": {
"evidence_files": [
{
"path": "runtime/support/telemetry/probe/impl.js",
"tlsh": "23119c5ab253d08f23c04695391c43e1482dc2d097dd51d1bbbc168ba2cd7914ad3a76",
"sha256": "74cabd564f982cad05f3366bbd8dfccdb1c61f1517cb401e1e657444e668d0f8"
},
{
"path": "runtime/support/telemetry/probe/f0d4b7.js",
"tlsh": "8ce0201725aff14fa6e85ea72f17c4dbc8820a00a21c4bd9fa0d0687206e007c0c0771",
"sha256": "8b334e1d6cd445ed52f797ed4e123d25f5be174ebb2700b15795c8034ec9d6e6"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "66951b67868ab6e5a2bf12634c382583336facf7",
"sha512_sri": "sha512-jYnQ4ncfvYXq6clch3ETiW/fZCpfEO2x+okCsa6VfHFBrLZNh7k/+rmLSC9kPfn8HrJEOPWBKytqlb7MqSqkvw=="
},
"filename": "blockchain-config-9.9.11.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33414 · Revision 1
- Added to Heist Feed
- Publisher date