MAL-2026-16352
Malicious code in @baanx/blockchain-config (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d) The package runs a bootstrap from both its install lifecycle script (`node index.js`) and its main module that invokes an obfuscated probe. The probe reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, concatenates them with a static tag (`bxcfg`) and a timestamp, and performs a `dns.resolve4` lookup against `<tag>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz`, exfiltrating installer identity over DNS to a non-first-party domain unrelated to the claimed baanx publisher. The exfil host and the `os`/`dns`/`userInfo`/`hostname`/`cwd`/`resolve4` API references are hidden in `String.fromCharCode`/hex-decoded byte arrays in `probe/impl.js` and sibling files `e9c3a6.js` / `f0d4b7.js`, and the `os` and `dns` modules are loaded through `module.constructor._load` with decoded name arrays to defeat static analysis. Behavior fires automatically on `npm install` and on `require('@baanx/blockchain-config')`.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @baanx/blockchain-config (npm). Pin to a known-safe version or switch to an alternative.