bnpl-blocks-atom-bnpl-promocode

{"modified":"2026-08-05T14:55:49Z","published":"2026-08-05T14:55:49Z","schema_version":"1.7.4","id":"MAL-2026-12887","summary":"Malicious code in bnpl-blocks-atom-bnpl-promocode (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6)\nOn require of the package's main entry, _helpers.js runs a bootstrap() routine that downloads an OS-specific binary from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf100-416.workers.dev) with a DNS TXT fallback under *.dl.wel1.ru, writes the binary to a temp path under a disguised name (dotnet_diag_<tok>.exe on Windows,.cache_<tok> on POSIX), chmods it 0755, and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true, stdio:\"ignore\"}).unref() (or spawn(\"cmd\"...) on Windows). Endpoint hostnames are assembled by Array.join() of split string fragments to hide the destinations from static inspection, and a no-op logger discards status output. A stamp file (/tmp/.analytics_state or %TEMP%\\analytics_state) is written to rate-limit re-execution, and environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked as a telemetry cover story. No signature or hash verification is performed on the downloaded payload.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-atom-bnpl-promocode"},"versions":["35.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"bc9d6324aa2195f6b1d051ab325658b90d5989773488561744bb24da647dd808","tlsh":"37b1a89a156670198bb0dbf0c7179415f69be66337808188fb5ca5841f7316483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-bnpl-promocode-35.9.1.tgz","hashes":{"sha1":"14458c12f19e998869114f7c16c6017ea693abf3","sha512_sri":"sha512-064IL2JDx7hWInND0yhr/LwQXpRBjFPh+cjoVV20NHLvGt/9YAXs7qWJFZP6591AfzREkSW3rUM6A4TB8v1KGg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-promocode/v/35.9.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015500","import_time":"2026-08-05T15:19:54.801684767Z","modified_time":"2026-08-05T14:55:49Z","sha256":"50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6","source":"amazon-inspector","versions":["35.9.1"]}]}}