bnotify-web-sdk
This report shows the evidence for bnotify-web-sdk@1.1.9. 15 of 16 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-14551 confirms this npm version as malicious.
Advisory
MAL-2026-14551
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bnotify-web-sdk (npm)
Details
The package was found to contain malicious code or consuming dependency that contains malicious code
## Source: ghsa-malware (9f94e04da2ba873e2dbc02daf8ccdf71ac80710b143908d5ed08797b88c48c37) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
There is no demonstrated malicious chain, but all executable distributed artifacts are deliberately obfuscated, leaving meaningful runtime behavior unverifiable by static source review. The observable behavior aligns with the advertised push SDK, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the SDK and calling initialize(), plus service-worker notification events.
Impact
Can receive/display notifications and report notification interactions; opaque artifacts prevent complete verification.
Mechanism
Obfuscated browser push-notification and network client.
AI rationale
There is no demonstrated malicious chain, but all executable distributed artifacts are deliberately obfuscated, leaving meaningful runtime behavior unverifiable by static source review. The observable behavior aligns with the advertised push SDK, so this warrants a warning rather than a block.
Evidence
package.jsondist/index.d.tsdist/index.jsdist/index.esm.jsservice-worker.jsREADME.md
Network endpoints1
bnotify.convexinteractive.com/api/notifications
Independent scan evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- All shipped runtime files are heavily obfuscated: dist/index.js, dist/index.esm.js, and service-worker.js.
- Obfuscation conceals the runtime endpoint/configuration flow, preventing reliable source verification.
- service-worker.js contains notification delivery, click, dismissal, fetch, and openWindow behavior.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Type declarations and README describe a web-push SDK API.
- The visible service-worker endpoint is package-aligned: bnotify.convexinteractive.com/api/notifications.
- No shell/process execution, filesystem harvesting, or destructive command strings were found.
Behavioral surface
DynamicRequire
HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings
Source & flagged code
2 flagged · loading sourcedist/index.jsView file
1(function(stringArrayFunction,_0x437bbf){const _0x1a1487={_0x50d74e:'vfK1',_0x5c0461:0xc22,_0x2fd0dc:0xab2,_0x313ace:'M!ql',_0x4cdd54:0x69d,_0x46f30:0x834,_0x36f513:0x35f,_0x576250...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.jsView on unpkg · L11(function(stringArrayFunction,_0x437bbf){const _0x1a1487={_0x50d74e:'vfK1',_0x5c0461:0xc22,_0x2fd0dc:0xab2,_0x313ace:'M!ql',_0x4cdd54:0x69d,_0x46f30:0x834,_0x36f513:0x35f,_0x576250...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L1Findings
2 High2 Medium3 Low
HighObfuscated Payload Loaderdist/index.js
HighObfuscated
MediumDynamic Requiredist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to bnotify-web-sdk@1.1.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing bnotify-web-sdk@1.1.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
16 known versions0.0.1-securitylatestClean—AllowPublishedAug 27, 2026, 2:00 AM1.3.3MaliciousMalwareBlockPublishedAug 26, 2026, 11:11 AM1.3.2MaliciousMalwareBlockPublishedAug 26, 2026, 10:09 AM1.3.1MaliciousMalwareBlockPublishedAug 26, 2026, 9:20 AM1.2.12MaliciousMalwareBlockPublishedJul 15, 2026, 11:39 AM1.2.11MaliciousMalwareBlockPublishedJul 15, 2026, 11:26 AM1.2.10MaliciousMalwareBlockPublishedJul 15, 2026, 11:21 AM1.2.9MaliciousMalwareBlockPublishedJul 15, 2026, 11:15 AM1.2.8MaliciousMalwareBlockPublishedJul 15, 2026, 10:59 AM1.2.5MaliciousMalwareBlockPublishedJul 15, 2026, 10:18 AM1.2.4MaliciousMalwareBlockPublishedJul 15, 2026, 10:15 AM1.2.3MaliciousMalwareBlockPublishedJul 15, 2026, 10:11 AM1.2.2MaliciousMalwareBlockPublishedJul 15, 2026, 10:07 AM1.2.1MaliciousMalwareBlockPublishedJul 15, 2026, 9:59 AM1.2.0MaliciousMalwareBlockPublishedJul 15, 2026, 9:56 AM1.1.9shownMaliciousMalwareBlockPublishedJul 15, 2026, 9:00 AM