bnpl-blocks-desktop-bnpl-link-group

{"modified":"2026-08-05T14:49:10Z","published":"2026-08-05T14:49:10Z","schema_version":"1.7.4","id":"MAL-2026-12931","summary":"Malicious code in bnpl-blocks-desktop-bnpl-link-group (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3419412ce27e6f0442a6e828cf62c4f8851be28a969e977a799559e038c75ea7)\nOn require of the package's main entry, index.js loads./_vendor, which reconstructs Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) via runtime string concatenation, downloads platform-specific binary bytes, writes them to a disguised temp filename (.cache_<hex> or dotnet_diag_<hex>.exe), chmods the file to 0755, and spawns it detached via /bin/sh -c '<path> &' on Unix or cmd.exe /c start /b on Windows. A DNS-based fallback discovery mechanism reassembles the domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru from split fragments. No hash or signature verification is performed on the downloaded payload, and the destinations are unrelated to any legitimate publisher of this package. A second copy of the dropper primitives (base64 chunk assembly, chmodSync to 0755, detached /bin/sh spawn, string-split require(\"child_\"+\"process\")) is bundled in lib/telemetry.js. Cover-story comments frame the behavior as analytics/telemetry and cache validation.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-link-group"},"versions":["35.4.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_vendor.js","sha256":"8c9b814d6e1b9becea48b873fc591b5b1d06feb4ea0c0ecbdbb9a43a5e75d88f","tlsh":"0aa1b55a06a670198bb097f4c71b4416f65be6a33780c1d4fbac59985fb2224c3b2dfc"},{"path":"lib/telemetry.js","sha256":"29f4dd60ef19b5e3dd6d822ab0228ac4d96d7d658b95e385a56d9152ad2ee76e","tlsh":"3d835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-link-group-35.4.1.tgz","hashes":{"sha1":"41d228ac582123a4347d8e26b7ca436291e8543e","sha512_sri":"sha512-zOCBxsrwbU5ri05tz38jlS1RF4l51mcCybHEXWLVxHZa0iyNNza+FB1UuIHZywYq7yRRmkDTXaGZWMWE+nxcSw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-link-group/v/35.4.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015454","import_time":"2026-08-05T15:19:52.362649055Z","modified_time":"2026-08-05T14:49:10Z","sha256":"3419412ce27e6f0442a6e828cf62c4f8851be28a969e977a799559e038c75ea7","source":"amazon-inspector","versions":["35.4.1"]}]}}