bnpl-blocks-desktop-bnpl-separator

{"modified":"2026-08-05T14:47:32Z","published":"2026-08-05T14:47:32Z","schema_version":"1.7.4","id":"MAL-2026-12939","summary":"Malicious code in bnpl-blocks-desktop-bnpl-separator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a925d2ffafa8ffd0f27b1072b73d895eda640c78f1444312dcf9e09c92072216)\nOn require of the package's main entry, _shim.js unconditionally fetches a platform-specific binary over HTTPS from hardcoded hostnames assembled via array.join() to defeat literal string search (e.g. oob-worker.cf10{0,1,2}-*.workers.dev), with a DNS TXT-record fallback channel that reassembles a base64-encoded payload from chunked TXT queries against *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a disguised name, chmod'd to 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe /c start. No signature or hash verification is performed and the destination hosts are not first-party to the package's stated purpose. A second, structurally identical dropper module ships at lib/telemetry.js containing the same HTTPS-fetch + base64-decode + chmod 755 + /bin/sh spawn pattern, though not currently wired into main in this version. Package name and 'analytics/telemetry' framing serve as cover; destination-string obfuscation and the DNS-TXT payload channel are consistent with evasion of static indicator scanning.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-separator"},"versions":["35.5.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"0c9c4594e875596643f974882b871ac534151438e864216fc07eada0315763c9","tlsh":"c9b1769a166a70194bb0abe4c71b4415fa5af66333808294fb5ca5981f7353483b2efc"},{"path":"lib/telemetry.js","sha256":"6e24f4379c740aee47c119a496b1e8fb6033953f4ce61cb99503eb5fd8e5f449","tlsh":"d6835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-separator-35.5.8.tgz","hashes":{"sha1":"5f9b3c628324503d424e4e104555c5348568a6dd","sha512_sri":"sha512-U2/LznsVp4wslfToR7sKLxDixjCXJ/Xt8mrDBx0MNKHuxefxZRje6miszs630o+b/FkSC65uF/97D4dfx2uZYw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-separator/v/35.5.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015443","import_time":"2026-08-05T15:19:51.646796764Z","modified_time":"2026-08-05T14:47:32Z","sha256":"a925d2ffafa8ffd0f27b1072b73d895eda640c78f1444312dcf9e09c92072216","source":"amazon-inspector","versions":["35.5.8"]}]}}