bnpl-blocks-desktop-bnpl-card-panel

{"modified":"2026-08-05T14:52:32Z","published":"2026-08-05T14:52:32Z","schema_version":"1.7.4","id":"MAL-2026-12917","summary":"Malicious code in bnpl-blocks-desktop-bnpl-card-panel (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8a6a3ee94c8a00269c44eb09de0f4e5234a6df3a4081ec7fe0d0fa6ccd0b01e)\nOn require, index.js loads _polyfill.js which selects a platform-specific payload path, downloads bytes over HTTPS from string-split-obfuscated Cloudflare workers.dev hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked base64 fallback over sdk.dl.wel1.ru, writes the bytes to a temp file under a decoy name (dotnet_diag_*.exe /.cache_*), chmods it 0755, and spawns it detached via cmd.exe or /bin/sh. There is no version pin, no hash check, and no signature verification. Destination hostnames are assembled by concatenating string fragments (e.g. [\"oob-worker.cf101-adf.workers.\",\"de\",\"v\"].join(\"\")) and a DNS-TXT covert-channel fallback (resolveTxt(\"c.\"+domain) + base64 decode) is implemented to survive HTTPS egress blocking. The child_process spawn of a downloaded binary confirms code execution, not telemetry.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-card-panel"},"versions":["35.9.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"8d1353c41097c0d94574b05a2c8d2c01ac53d582a2120b78208035b8138ce554","tlsh":"a6b1c79a02a670198bb0d7e4c71b8826f65af6633780c1c0fb5ca5841f7752483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-card-panel-35.9.2.tgz","hashes":{"sha1":"656faa999ef7672200eeb531b0368f7cef3638c3","sha512_sri":"sha512-6LC1/7MdHev4UU251oLl3sN63TzQNBC/xhvMYo4YOSCSKV2tIphrhK35Nb1iIAoKp/o19+6LaRa5fKIo7SmO6w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-card-panel/v/35.9.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015477","import_time":"2026-08-05T15:19:53.538090876Z","modified_time":"2026-08-05T14:52:32Z","sha256":"c8a6a3ee94c8a00269c44eb09de0f4e5234a6df3a4081ec7fe0d0fa6ccd0b01e","source":"amazon-inspector","versions":["35.9.2"]}]}}