bnpl-blocks-atom-bnpl-notification

{"modified":"2026-08-05T14:55:25Z","published":"2026-08-05T14:55:25Z","schema_version":"1.7.4","id":"MAL-2026-12884","summary":"Malicious code in bnpl-blocks-atom-bnpl-notification (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (80f343dda3cb4e6b3420db34a6a801aeeeaf60ecf1ea23ad78de4c7605b954d2)\nindex.js unconditionally requires./_runtime on load. _runtime.js reconstructs Cloudflare Workers hostnames (oob-worker.cf10{1,2,3}-*.workers.dev) via string-split/array-join obfuscation, with a DNS-TXT chunked-base64 fallback channel keyed on platform, downloads platform-specific opaque bytes over HTTPS, writes them to /var/tmp or %TEMP% under cover names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods 0755 on POSIX, and spawns the payload detached via /bin/sh -c 'path &' or cmd.exe /c start. lib/telemetry.js ships a second, dormant copy of the same dropper machinery (require(\"child_\" + \"process\"), base64 chunk assembly, chmod 0755, /bin/sh -c spawn), presented as an 'analytics SDK', not currently on the reachable graph from the main entry but shipped in the tarball. The package name presents as a BNPL UI notification block; the actual behavior on require is fetch-and-execute of attacker-controlled bytes, which is unrelated to any legitimate purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-atom-bnpl-notification"},"versions":["35.3.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"d13ff2d356733af74235bd492e99d198ba1752aa7948a32accd0480f67d88c85","tlsh":"9fa18496156ab0184b70ebf4c6178826fa5bf6a33281c284f75c95945f7312482b2efc"},{"path":"lib/telemetry.js","sha256":"6a331dedd2530f797e2f770ad8f15ed47a7c301ae70489fec0de63aabd28643e","tlsh":"be835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-bnpl-notification-35.3.8.tgz","hashes":{"sha1":"abd6084e57047a451f6b3ab4934847b544f92600","sha512_sri":"sha512-NuRLOzyUQDPvCYdbqzphkLYiDWDcr0AqPq7GMdTbhilvSx3AQl74oGiMu4B1vIHguoBj/7mhCBQouERtpanu/w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-notification/v/35.3.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015497","import_time":"2026-08-05T15:19:54.615083266Z","modified_time":"2026-08-05T14:55:25Z","sha256":"80f343dda3cb4e6b3420db34a6a801aeeeaf60ecf1ea23ad78de4c7605b954d2","source":"amazon-inspector","versions":["35.3.8"]}]}}