Malicious code in @baanx/abis (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b) Package declares `scripts.install: node index.js`, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename (`process.cwd()`), joins them with a timestamp and the prefix `bxabis` under the suffix `oob.algamil7x.xyz`, and issues a `dns.resolve4` lookup on the composed name — a DNS-tunnel exfiltration of installer host identity to an attacker-controlled domain. The behavior fires automatically on `npm install` and again on `require`. The module names, method references (`_load('os')`, `_load('dns')`, `userInfo`, `hostname`, `cwd`, `resolve4`), the prefix `bxabis`, and the destination domain are all reconstructed from char-code hex arrays, and the surrounding files carry `telemetry`/`connectivity probe` cover-story comments. The destination is unrelated to any legitimate endpoint of a smart-contract ABI library. ## Source: ghsa-malware (80dc9468907fe0d16035abc09dc69d7c4a35281f1e302aff8b5872dca778cb19) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsi
MAL-2026-16351
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16351
@baanx/abis
Source reference: /affected/0/package/name
- Affected versions
- 9.9.11
Source reference:
/affected/0/versions9.9.9Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@baanx/abis",
"purl": "pkg:npm/%40baanx/abis",
"ecosystem": "npm"
},
"versions": [
"9.9.11",
"9.9.9"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/abis/MAL-2026-16351.json",
"indicators": {
"evidence_files": [
{
"path": "runtime/support/telemetry/probe/impl.js",
"tlsh": "a4119c5ab253d0cf23d04699391c53e1482d82d097dd11d2bbbc169ba28d7914ad3a66",
"sha256": "ae4b73688385daef20c226d80792a6c877557cdfce7a925c14da94b27454621c"
},
{
"path": "runtime/support/telemetry/probe/c7a1f4.js",
"tlsh": "73f0595166a3d19f77d69ac35f4190a0acb60a40b60ed0d5fa2c1bde00eeb13e9c54b0",
"sha256": "f7942b52b33a05f44ce43c1cc581fa1140cbbef03acdba961ade9f4a44cb03e1"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "9467fff23faf27f4a13db5422a7b3ed51e996b6d",
"sha512_sri": "sha512-L5KzeFHJlL12gkUX6WvUtXrbEEqopKRW4A6K4qWK0nXZwURwfbi+5W6mf9FnZY4sTuT2jbnEWh77OuSkOc/QgQ=="
},
"filename": "abis-9.9.11.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33412 · Revision 1
- Added to Heist Feed
- Publisher date