bnpl-blocks-desktop-bnpl-action-panel

{"modified":"2026-08-05T14:51:48Z","published":"2026-08-05T14:51:48Z","schema_version":"1.7.4","id":"MAL-2026-12911","summary":"Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0)\nOn require() of the package's main entry, _compat.js reconstructs Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) from split string fragments joined at runtime, downloads a platform-specific binary via https.get, writes it to a temp path disguised as a system file (`.cache_<hex>` on unix, `dotnet_diag_<hex>.exe` on Windows), chmods it 0755, and spawns it detached via `/bin/sh -c` on unix or `cmd /c start /b` on Windows. If the HTTPS fetch fails, the code falls back to a DNS-over-TXT channel querying chunked TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-decodes the concatenated chunks, and uses the result as the executable payload. The `child_process` module is likewise obtained via `require(\"child_\"+\"process\")` in a sibling telemetry file, and cover-story comments label the behavior as analytics/telemetry. The runtime string reconstruction of destinations, disguised filenames, detached-spawn pattern, and DNS-TXT egress-bypass channel are consistent with a load-time remote code execution dropper against any host that installs or imports this package.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-action-panel"},"versions":["35.3.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"b87e9b35da4ec601311539719a1c1c5161c4986bc885191d3ad5eedcfa408116","tlsh":"2bb1959a166671184fb0e7e4c7178825f65bf66337808294fb9ca5845f7312483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-action-panel-35.3.1.tgz","hashes":{"sha1":"b5852228c340a0597a329ae46dd75ceb739dc7d7","sha512_sri":"sha512-y9WUg4A8Liitu8Oib0pGkmWXW1YgVtK6NJAjAJg2Nx8BRcxErlCJdC3aALBkzxz9jTo8yczA6CpPbWfRH8deQg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-action-panel/v/35.3.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015472","import_time":"2026-08-05T15:19:53.273752277Z","modified_time":"2026-08-05T14:51:48Z","sha256":"6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0","source":"amazon-inspector","versions":["35.3.1"]}]}}