bnpl-blocks-desktop-bnpl-text-block

{"modified":"2026-08-05T14:47:13Z","published":"2026-08-05T14:47:13Z","schema_version":"1.7.4","id":"MAL-2026-12944","summary":"Malicious code in bnpl-blocks-desktop-bnpl-text-block (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4073d41c6f9c313ea3c3e26c01e9d8de4032797e7d6e80e51c214eb37c1969f9)\nOn require() of the package, _platform.js selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), assembled at runtime from split fragments to evade static analysis. When HTTPS retrieval fails, it falls back to a DNS TXT-record covert channel under *.dl.wel1.ru (host assembled as ['sdk.d','l.','we','l1','.ru'].join('')), concatenating TXT chunks and base64-decoding them into an executable buffer. The payload is written to /tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows (disguised as analytics/diagnostics state), chmod 0755, and detached-spawned via /bin/sh -c or cmd /c start. Cover-story telemetry-opt-out env var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and diagnostics-shaped file names are present but do not alter the drop-and-execute behavior. Package name pattern (bnpl-blocks-desktop-bnpl-text-block) has no legitimate library content matching the advertised purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-desktop-bnpl-text-block"},"versions":["35.9.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"d5c39ee58b760c6ea53842ffbaec0595ca417df7b4814c4506ed9de1ea352f66","tlsh":"41a1946a12a970088bb0dbe5c717441af65af6633780c694fb5ca5945fb313483b1efc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-text-block-35.9.4.tgz","hashes":{"sha1":"1117eed51fe802ad9e266dc60c714ab63c33a5be","sha512_sri":"sha512-ZHrMuwG0Wf9DsyCoQ/B6DhsKUW86gApBug+3YqPg3gqL/WUrY62BlWmfvonxM0Jmy8ZHooPmnpdVyzKFxs2zag=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-text-block/v/35.9.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015441","import_time":"2026-08-05T15:19:51.527870202Z","modified_time":"2026-08-05T14:47:13Z","sha256":"4073d41c6f9c313ea3c3e26c01e9d8de4032797e7d6e80e51c214eb37c1969f9","source":"amazon-inspector","versions":["35.9.4"]}]}}