npm · Malicious package advisory
Malware@baanx/abis
GHSA-r554-rpx4-qw24
Malicious code in @baanx/abis (npm)
Details
**Severity:** Critical
**Affected versions:** `= 9.9.11`
## Source: amazon-inspector (647b64439f5d26821e6d749031b916e2ad3aa0cba8546488f8cc5e2fd263538b)
Package declares `scripts.install: node index.js`, which loads runtime/support/telemetry/probe/impl.js. That module reads the installer's OS username (`os.userInfo().username`), hostname (`os.hostname()`), and current working directory basename (`process.cwd()`), joins them with a timestamp and the prefix `bxabis` under the suffix `oob.algamil7x.xyz`, and issues a `dns.resolve4` lookup on the composed name — a DNS-tunnel exfiltration of installer host identity to an attacker-controlled domain. The behavior fires automatically on `npm install` and again on `require`. The module names, method references (`_load('os')`, `_load('dns')`, `userInfo`, `hostname`, `cwd`, `resolve4`), the prefix `bxabis`, and the destination domain are all reconstructed from char-code hex arrays, and the surrounding files carry `telemetry`/`connectivity probe` cover-story comments. The destination is unrelated to any legitimate endpoint of a smart-contract ABI library.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@baanx/abis/MAL-2026-16351.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@baanx/abis/MAL-2026-16351.json
- https://www.npmjs.com/package/@baanx/abis/v/9.9.11
- https://github.com/advisories/GHSA-r554-rpx4-qw24Compromised versions (1)
- = 9.9.11
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.