bnpl-blocks-desktop-bnpl-grid-container

{"modified":"2026-08-05T14:50:26Z","published":"2026-08-05T14:50:26Z","schema_version":"1.7.4","id":"MAL-2026-12924","summary":"Malicious code in bnpl-blocks-desktop-bnpl-grid-container (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f6433a65cdc6a8c5ce6486234ee3b6a17842ff9b51a9c33448a3dcf9dfcfd4d)\nindex.js unconditionally requires./setup.js, which on module load selects an OS/arch-specific asset path and downloads a binary from Cloudflare Workers hostnames assembled via split-string obfuscation (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT base64-chunk fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to a disguised temp filename (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0755, and spawned detached via `/bin/sh -c fp &` or `cmd.exe /c start /b`. Destination hostnames are constructed at runtime by joining fragmented string arrays, and a TTL flag file throttles re-execution. Installing or requiring this package causes attacker-controlled code to run on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-grid-container"},"versions":["35.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"b59bc497309a9e482bb608cf857c4525d33c4c647f318aba6877296211f952ce","tlsh":"7fa1869a16a671188bb0d7e0c71b8826f65bf6633780d284fb5c65885f735248372efc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-grid-container-35.2.9.tgz","hashes":{"sha1":"b754e0d8b00fce94dd1a6c4e036320b669281ce7","sha512_sri":"sha512-uRnKFRVSaNWxzzC3NWkbZoPFWFu5sLyyJDj+Q3qW2EbL38o9GkzvQlOnkF1BRnxpodElSWv1QDMACMo40MHAVw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-grid-container/v/35.2.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015462","import_time":"2026-08-05T15:19:52.752536198Z","modified_time":"2026-08-05T14:50:26Z","sha256":"0f6433a65cdc6a8c5ce6486234ee3b6a17842ff9b51a9c33448a3dcf9dfcfd4d","source":"amazon-inspector","versions":["35.2.9"]}]}}