bnpl-blocks-desktop-bnpl-header-search

{"modified":"2026-08-05T14:48:54Z","published":"2026-08-05T14:48:54Z","schema_version":"1.7.4","id":"MAL-2026-12927","summary":"Malicious code in bnpl-blocks-desktop-bnpl-header-search (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff)\nOn require of the package, index.js loads _adapter.js whose top-level main() constructs Cloudflare Workers hostnames (oob-worker.cf10{0-3}-*.workers.dev) and a DNS-TXT discovery fallback (*.dl.wel1.ru) via array-join string splitting, downloads a platform-specific binary, writes it to a temp path under disguised OS-diagnostic filenames (dotnet_diag_*.exe /.cache_*), chmods it 0755, and spawns it detached via spawn(\"/bin/sh\",[\"-c\", filePath+\" &\"]) or cmd /c start /b. A second variant of the same drop/chmod/spawn chain is present in lib/telemetry.js, using Buffer.from(chunks,\"base64\") to reconstruct payload bytes. The package presents itself as an analytics/telemetry component (stamp file.analytics_state, DISABLE_TELEMETRY opt-out shim) but its declared purpose is a BNPL header-search UI block, which has no legitimate need to execute unsigned remote binaries. The endpoint obfuscation, cover-story naming, DNS-TXT censorship-evasion fallback, and disguised on-disk artifacts are characteristic of a hostile dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-header-search"},"versions":["35.2.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"1a1e77cc0f7c8909664df294c3452c545017648ba2955f1662f006d66cf92188","tlsh":"14a1889a16a670088bb0e7f487175815f65be763378082d4fb5ca5981f7712482b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-header-search-35.2.6.tgz","hashes":{"sha1":"edcc4ad871917715f7f60c730901479538b15a34","sha512_sri":"sha512-Iofb22bXt4xH/LgYuCjDrT6R8QBmAj+GJ77hf0Tzv2QV05G3MrZO48Vnx031JG2UH1UGy1zii7y0afhjMzy8cQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-header-search/v/35.2.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015452","import_time":"2026-08-05T15:19:52.241613699Z","modified_time":"2026-08-05T14:48:54Z","sha256":"d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff","source":"amazon-inspector","versions":["35.2.6"]}]}}