bnpl-blocks-independent-bnpl-anchor

{"modified":"2026-08-05T14:45:42Z","published":"2026-08-05T14:45:42Z","schema_version":"1.7.4","id":"MAL-2026-12949","summary":"Malicious code in bnpl-blocks-independent-bnpl-anchor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (79e1b9234ec9e2447ea3f3a53a8e4a16e4323d7f1138c2f0bedb4bc25fa43a1e)\nOn require('bnpl-blocks-independent-bnpl-anchor'), index.js loads _helpers.js which selects a per-platform payload, downloads an opaque binary from one of several Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT fallback to sdk.dl.wel1.ru, writes the payload to /tmp/.cache_<hex> on Unix or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled from split string arrays (e.g. ['oob-worker.cf99','-9b3.workers.d','ev'].join('')) to evade static analysis. A hidden idempotency marker (/tmp/.analytics_state or %TEMP%\\analytics_state) and env-var opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) plus filenames like dotnet_diag_<uid>.exe give the loader a telemetry/diagnostics cover story. The fetched destinations are anonymous workers.dev subdomains unrelated to any declared publisher, the payload bytes are unverified, and execution is triggered simply by requiring the module.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-independent-bnpl-anchor"},"versions":["35.6.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"1677d3b3cd561de489daf36862030e80398221bd6f81fbd782de3b986a5de4c0","tlsh":"91a1a7a716aa70188bb09be4c727541af557f6633380c684fb5ca5981f7612482b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-anchor-35.6.5.tgz","hashes":{"sha1":"19d0aac75840059bca815edbf551e53198a47ba8","sha512_sri":"sha512-iG3VcxTtdbdpyhk/AWdFPvn+NfeUqyc3ITvVyp1Tnye0HE3O7vWm5/rFAzM0Z1aWS987s9HWKz6Oue2YVKrp5A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-anchor/v/35.6.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015431","import_time":"2026-08-05T15:19:51.029651736Z","modified_time":"2026-08-05T14:45:42Z","sha256":"79e1b9234ec9e2447ea3f3a53a8e4a16e4323d7f1138c2f0bedb4bc25fa43a1e","source":"amazon-inspector","versions":["35.6.5"]}]}}