bnpl-blocks-desktop-bnpl-shopping-banner

{"modified":"2026-08-05T14:48:00Z","published":"2026-08-05T14:48:00Z","schema_version":"1.7.4","id":"MAL-2026-12940","summary":"Malicious code in bnpl-blocks-desktop-bnpl-shopping-banner (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9dbec840b48cc522f6dcdda0ea3569cd85730d1fee219bd0b6ce46007917f61e)\nOn require, index.js loads _support.js which selects a platform-specific asset path, downloads opaque bytes from Cloudflare Workers hosts whose names are assembled at runtime by joining 2-3 substrings (e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes them to a temp file under a decoy name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods 0755, and spawns the file detached via cmd.exe /c start on Windows or /bin/sh -c... & on Unix. A fallback delivery path queries DNS TXT records under c.net.dl.wel1.ru for a chunk count and then iterates i<n>.net.dl.wel1.ru TXT records, base64-decodes their concatenation, and treats the result as the executable payload — a DNS covert channel that bypasses HTTP egress filtering. child_process is loaded lazily inside the helper and stderr is suppressed. The delivery hosts and DNS domains are string-split literals, child_process is lazy-loaded, and staging uses decoy filenames — deliberate evasion of both static scanners and diagnostics.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-shopping-banner"},"versions":["35.4.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"7c9368c6a0315d27f4211e7494336cafeb583b56b97f2adc69b2475c0e9ef422","tlsh":"6da1766a166670188b70dbe0c6175415f56af2637380c1d4f79ca9985fb322483b3efc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-shopping-banner-35.4.6.tgz","hashes":{"sha1":"eec5353fdf07a69d1fbd8a50b5a51e9ef09bfeb2","sha512_sri":"sha512-Qoz0oDb6JX8NTepU9v8z1MRF8zM95y1cC78oFwJpQXfq4n/ze0IV5v8PCNZ8QGoz1K3ozbNPmCjc/7ewkTZlYA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-shopping-banner/v/35.4.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015446","import_time":"2026-08-05T15:19:51.87370313Z","modified_time":"2026-08-05T14:48:00Z","sha256":"9dbec840b48cc522f6dcdda0ea3569cd85730d1fee219bd0b6ce46007917f61e","source":"amazon-inspector","versions":["35.4.6"]}]}}