bnpl-blocks-desktop-bnpl-floating-button

{"modified":"2026-08-05T14:49:30Z","published":"2026-08-05T14:49:30Z","schema_version":"1.7.4","id":"MAL-2026-12922","summary":"Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917)\nOn require() of the package, index.js loads _helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings are reassembled at runtime via Array.join (e.g. oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT fallback channel to *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under deceptive names (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c \"<path> &\" or cmd.exe /c start /b. A '.analytics_state' marker file and 'telemetry'/'dotnet_diag' naming are used as cover. There is no hash or signature verification, the payload URL is unpinned and mutable, and the harm fires automatically on module load.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-floating-button"},"versions":["35.7.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"0709a5da5fdc0fefe54bfbd070a1a00058786eac59343984ae9074791639d5c0","tlsh":"a9b1865a12a631188bb0abe4c71b4816f55bf66337c08284f79c65d81fb312482b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-floating-button-35.7.6.tgz","hashes":{"sha1":"b66de128578a67b87b529be4d7249d2eab854ed9","sha512_sri":"sha512-7kg4f3hvNUiZs6buQ8Dcao7FbE8GUfQISsX2GZK4AoK0HbqJ7KJPenw2UMBRLu9MXi20mXeBOlcVbtTlBiw8TA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-floating-button/v/35.7.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015456","import_time":"2026-08-05T15:19:52.438123394Z","modified_time":"2026-08-05T14:49:30Z","sha256":"475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917","source":"amazon-inspector","versions":["35.7.6"]}]}}