@baanx/blockchain-config

GHSA-7cc3-jjqj-wrm5

Malicious code in @baanx/blockchain-config (npm)

Details

**Severity:** Critical

**Affected versions:** `= 9.9.11`

## Source: amazon-inspector (0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d)
The package runs a bootstrap from both its install lifecycle script (`node index.js`) and its main module that invokes an obfuscated probe. The probe reads `os.userInfo().username`, `os.hostname()`, and the basename of `process.cwd()`, concatenates them with a static tag (`bxcfg`) and a timestamp, and performs a `dns.resolve4` lookup against `<tag>.<user>.<host>.<cwd>.<ts>.oob.algamil7x.xyz`, exfiltrating installer identity over DNS to a non-first-party domain unrelated to the claimed baanx publisher. The exfil host and the `os`/`dns`/`userInfo`/`hostname`/`cwd`/`resolve4` API references are hidden in `String.fromCharCode`/hex-decoded byte arrays in `probe/impl.js` and sibling files `e9c3a6.js` / `f0d4b7.js`, and the `os` and `dns` modules are loaded through `module.constructor._load` with decoded name arrays to defeat static analysis. Behavior fires automatically on `npm install` and on `require('@baanx/blockchain-config')`.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@baanx/blockchain-config/MAL-2026-16352.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@baanx/blockchain-config/MAL-2026-16352.json
- https://www.npmjs.com/package/@baanx/blockchain-config/v/9.9.11
- https://github.com/advisories/GHSA-7cc3-jjqj-wrm5

Compromised versions (1)

= 9.9.11

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.