checkout-bnpl-logic

{"modified":"2026-08-05T14:15:08Z","published":"2026-08-05T14:15:08Z","schema_version":"1.7.4","id":"MAL-2026-12545","summary":"Malicious code in checkout-bnpl-logic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e)\nThe package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with `require(\"./_polyfill\")`, which runs on every consumer import. _polyfill.js reassembles hostnames from string arrays at runtime, fetches a platform-specific binary from anonymous Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a base64-over-DNS-TXT fallback channel through *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru), writes the opaque bytes to a hidden temp path (/tmp/.cache_<hex> or %TEMP%/dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via `spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}).unref()` (or the cmd equivalent on Windows), with stderr silenced. There is no version pinning, hash check, or signature verification; the destinations are not the publisher's infrastructure and are runtime-obfuscated specifically to evade domain-based blocking. The Logger class is a decoy facade; the sole effect of importing this package is to drop and execute an attacker-controlled binary on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"checkout-bnpl-logic"},"versions":["35.9.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"cc00f4cf3d5b86e954ea6703a29b29798180cb9c74b68354f13773eb553428d8","tlsh":"92b1b89a166a701987b097e4c72b5416f65bf663338092d4fb6c95980fb31248372efc"},{"path":"index.js","sha256":"3918e4317632da3f118859ef6899963cb2a53356e3d534170b0ad077aceb5ef6","tlsh":"6c119b6267ed16475172a364cde380037a2ad29ea853b2dc734c53fe0fbd5581625e32"}],"package_integrity":[{"filename":"checkout-bnpl-logic-35.9.2.tgz","hashes":{"sha1":"37b9b29d651921c6024424121f0676868530658a","sha512_sri":"sha512-ii3zNoOWKXizajPPxS3SOdgFmgPMe/1lyTXEPTnfTJSmiPJ4OzhH5bVYYPtloOKZeblzXABuOwwcoDvqVSHtIQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-bnpl-logic/v/35.9.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015226","import_time":"2026-08-05T14:20:14.63843203Z","modified_time":"2026-08-05T14:15:08Z","sha256":"cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e","source":"amazon-inspector","versions":["35.9.2"]}]}}