bnpl-blocks-desktop-bnpl-table

{"modified":"2026-08-05T14:48:17Z","published":"2026-08-05T14:48:17Z","schema_version":"1.7.4","id":"MAL-2026-12943","summary":"Malicious code in bnpl-blocks-desktop-bnpl-table (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53a00a782a1b951d114dd07c4e2e5bf08226730274beb0b88842034b5c71e9dd)\nOn require of the package, index.js unconditionally loads _adapter.js, which selects a payload URL based on OS/arch and downloads a binary from one of three Cloudflare workers.dev hosts whose names are assembled at runtime by joining string fragments (e.g., [\"oob-work\",\"er.cf99-9b3\",\".w\",\"or\",\"kers\",\".dev\"].join(\"\")), with a DNS-TXT covert-channel fallback resolving through *.dl.wel1.ru. The downloaded bytes are written to a temp path under a deceptive name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0755, and spawned detached via /bin/sh -c \"<path> &\" or cmd.exe /c start /b. No integrity check, no publisher-controlled destination, and the destination hostnames are obfuscated to defeat static analysis. Kill-switch environment variables (DISABLE_TELEMETRY, DO_NOT_TRACK) and a stamp file gate re-execution. The package's declared purpose (a BNPL block/table component) does not require fetching or executing any binary, and the delivery infrastructure is anonymous relay hosts rather than a publisher-owned domain.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-table"},"versions":["35.4.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"c1aa1c45576b9a24eedf91a9db39a62b5e5b6107f4122304db01f2f21064e54f","tlsh":"f8a1875a05a6b0184bb0dbe0c61b8816f65bf6633781c188f79c69989f735248372dfc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-table-35.4.7.tgz","hashes":{"sha1":"63c0f8611d8c6d89e982dd814ac53136b5d09668","sha512_sri":"sha512-VgWqAqOcPjMCrjXv5aJF7MN+O3fRtbnVgTI8BnyNVaTkt0rGJKIXABckeYJYs1zRK7zFdVjrtvNkzP8sxeOrIA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-table/v/35.4.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015448","import_time":"2026-08-05T15:19:52.04576073Z","modified_time":"2026-08-05T14:48:17Z","sha256":"53a00a782a1b951d114dd07c4e2e5bf08226730274beb0b88842034b5c71e9dd","source":"amazon-inspector","versions":["35.4.7"]}]}}