bnpl-blocks-atom-bnpl-popup

{"modified":"2026-08-05T14:54:50Z","published":"2026-08-05T14:54:50Z","schema_version":"1.7.4","id":"MAL-2026-12885","summary":"Malicious code in bnpl-blocks-atom-bnpl-popup (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb)\nOn require() of this package, index.js loads _shim.js which assembles obfuscated non-publisher URLs by joining split string fragments (resolving to a *.workers.dev host, with a DNS-TXT covert-channel fallback under a.ru domain that reconstructs a payload from base64-encoded TXT records at c.<domain> and <i>.<domain>). _shim.js downloads a platform-specific binary, writes it to /tmp or %TEMP% under a disguised filename (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref() (or the cmd equivalent). No hash or signature verification is performed. A second copy of the dropper is shipped in lib/telemetry.js (labeled as an 'Analytics SDK') using the same shape with split-string API names such as require('child_'+'process') and fs['chmod'+'Sync']; it is not wired into the current entry point but stages the same capability. The destination hosts are not first-party to the package, and the string-splitting plus DNS-TXT channel are anti-analysis tradecraft rather than legitimate telemetry configuration.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-atom-bnpl-popup"},"versions":["35.4.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"0e144270d954fa7a1567a909f5b094a8bb1f30b9ce629d2dceb3a52f20cae62a","tlsh":"84a1859a166a71188bb097e487275816f55ff6633380c2d4fb9ca5884f7612483b2efc"},{"path":"lib/telemetry.js","sha256":"0166680cee7d2b69ebc99577c9096e344a7511e7911e6de5052d2d8f9ac0d0db","tlsh":"13835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-bnpl-popup-35.4.7.tgz","hashes":{"sha1":"3f974a37c5bfd5ce0c60de357c38381b1d183419","sha512_sri":"sha512-KU6BH+MKVKwT074nd3drSxcgHADTacH8gLAYrHkQP7Y2oeuWhGPosUhFvy8+j7/Z3ROxYAFeHeoDOiMywPA0jg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-popup/v/35.4.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015493","import_time":"2026-08-05T15:19:54.345482751Z","modified_time":"2026-08-05T14:54:50Z","sha256":"6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb","source":"amazon-inspector","versions":["35.4.7"]}]}}