bnpl-blocks-independent-bnpl-documents

{"modified":"2026-08-05T14:45:09Z","published":"2026-08-05T14:45:09Z","schema_version":"1.7.4","id":"MAL-2026-12954","summary":"Malicious code in bnpl-blocks-independent-bnpl-documents (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3a6696fe044c6853369150682d33490cf557f26081c7143ed87f7a3624dda53d)\nOn require of bnpl-blocks-independent-bnpl-documents, index.js loads _support.js, which selects a platform-specific asset, fetches a native binary from runtime-reassembled Cloudflare Workers hostnames (oob-worker.cf10{0-3}-*.workers.dev) with a DNS-TXT chunked-base64 fallback to fragments joining to *.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are split across string arrays and joined at runtime to evade static matching. lib/telemetry.js ships a second, equivalent SDK-styled implementation of the same dropper (HTTPS+DNS transport, base64 chunk reassembly, chmod 0755, /bin/sh spawn) that is not reached from index.js in this version but is present in the tarball. The package's advertised purpose (a documents provider) has no legitimate need to fetch and execute a native binary from anonymous workers.dev hosts, and the 'analytics'/opt-out framing is cover-story.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-independent-bnpl-documents"},"versions":["35.6.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"338f9feca23ae53a68fc457b1bbf56daa4e763b9be94b3b0c872c00a544e2185","tlsh":"45b1889a15a670198bb0d7e58717541af65bf6633380c298fa5ca5881f73134c3b2efc"},{"path":"lib/telemetry.js","sha256":"81623633b870eeaae37b8a853387f2551433040ce5b804d9cadfcf6759ba732a","tlsh":"64835056566a142186b2b368df234107ff3685272642429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-documents-35.6.6.tgz","hashes":{"sha1":"e69ae44115d5e933f60340ba0cfc2b4c196de29c","sha512_sri":"sha512-2h3Y0L9DOU70MbK/Dmya5wZMFlDAcGpVqwubt6lMdx+YTbODfFxG6/kMDa/BfjeLufmht32fxq6LNwN/+E4tBg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-documents/v/35.6.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015427","import_time":"2026-08-05T15:19:50.797487262Z","modified_time":"2026-08-05T14:45:09Z","sha256":"3a6696fe044c6853369150682d33490cf557f26081c7143ed87f7a3624dda53d","source":"amazon-inspector","versions":["35.6.6"]}]}}