Malicious Code Vulnerability in @baanx/blockchain-config Package
Summary
MAL-2026-16352: Malicious code in @baanx/blockchain-config (npm). Affects @baanx/blockchain-config versions 9.9.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @baanx/blockchain-config package is an npm module designed to facilitate blockchain configuration for applications. It is intended to provide developers with tools and settings necessary for integrating blockchain functionalities. However, this package has been found to contain malicious code that compromises user data and system integrity.
Vulnerability Detail
The vulnerability originates from the package's install lifecycle script and its main module, which executes an obfuscated probe. This probe collects sensitive information such as the username, hostname, and current working directory, concatenates them with a static tag and timestamp, and performs a DNS lookup to exfiltrate this data to a non-first-party domain. The malicious behavior is triggered automatically during the installation of the package or when it is required in an application, posing significant risks to user privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @baanx/blockchain-configIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the @baanx/blockchain-config package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @baanx/blockchain-config package contains a serious vulnerability that exfiltrates sensitive user information. It is essential to update the package to a secure version and consider alternative solutions while monitoring for vulnerabilities using tools like Vulert.
See every vulnerability recorded for @baanx/blockchain-config →
FAQ
The malicious code collects sensitive user information and exfiltrates it to an external server via DNS lookups.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application by visiting the Vulert playground at Vulert Scanner.
If an immediate update is not possible, refrain from using the package and look for alternative solutions until a secure version is available.
Regularly audit your dependencies and use tools like Vulert to monitor for vulnerabilities in your open-source packages.
Using the compromised package can lead to unauthorized data access, privacy breaches, and potential exploitation of your application.
