bnpl-blocks-atom-desktop-bnpl-highlighted-text

{"modified":"2026-08-05T14:52:58Z","published":"2026-08-05T14:52:58Z","schema_version":"1.7.4","id":"MAL-2026-12902","summary":"Malicious code in bnpl-blocks-atom-desktop-bnpl-highlighted-text (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2349ee7ea5e3f9098d665ff904b6dd6dba444d3f09c45654be5bfd56b8248960)\nOn require() of the package, index.js loads _platform.js, which assembles destination hostnames at runtime from split-string arrays to hide them from static inspection. The resolved hosts are Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev) with a DNS-TXT covert-channel fallback over subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The code fetches a platform-specific binary, writes it under a disguised filename to /tmp (.cache_<rand>) on POSIX or %TEMP% (dotnet_diag_<rand>.exe) on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd with stdio ignored and unref(). A second file, lib/telemetry.js (81KB), ships in the tarball and contains parallel dropper logic (HTTPS+DNS transport, base64 chunk decoding, /bin/sh spawn, fs[\"chmod\"+\"Sync\"] with 0755) that is not currently referenced by index.js but is present and activatable. The destinations are non-publisher, the payload is opaque and unpinned, the filenames are disguised, the destinations are obfuscated, and execution is detached — the shape of a second-stage dropper granting arbitrary code execution on any host that installs or requires the package.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-atom-desktop-bnpl-highlighted-text"},"versions":["35.2.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"3a5b8405166dfd533091d1ab5764a46ffa59bdff5ddc4d4a7425a5e20934a7ac","tlsh":"c7b19796166ab0184bb0ebf4c6174825f65bf6633681c2c4f75ca9845fb31248371efc"},{"path":"lib/telemetry.js","sha256":"dcf14aa92bc4036a863edef1094a4117694bd2301e442847758429867eaf9710","tlsh":"45835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-desktop-bnpl-highlighted-text-35.2.3.tgz","hashes":{"sha1":"5da848f3b47fcc4d5c139ec75dbce377943b1b16","sha512_sri":"sha512-aq//WV/2uvB4u5Zw2O9O0LyPIecpMczYDFK4oW1Mny2EI/1DPxjJxKJp5skiezaupRGElqbGz7va8D4iV5iz1Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-desktop-bnpl-highlighted-text/v/35.2.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015480","import_time":"2026-08-05T15:19:53.686159479Z","modified_time":"2026-08-05T14:52:58Z","sha256":"2349ee7ea5e3f9098d665ff904b6dd6dba444d3f09c45654be5bfd56b8248960","source":"amazon-inspector","versions":["35.2.3"]}]}}