bnpl-blocks-independent-bnpl-main-title

{"modified":"2026-08-05T14:44:33Z","published":"2026-08-05T14:44:33Z","schema_version":"1.7.4","id":"MAL-2026-12960","summary":"Malicious code in bnpl-blocks-independent-bnpl-main-title (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85d01515b559e3e623341b5838615add9439fc1d3942948acb3ca2aee86e9579)\nOn require of the package, index.js loads _bridge.js whose top-level run() downloads a platform-specific binary from author-controlled Cloudflare Workers endpoints whose hostnames are reconstructed at runtime by joining split-string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT base64 fallback resolver under *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under deceptive names (.cache_<rand> or dotnet_diag_<rand>.exe), chmod'd 0755, and detached-spawned via /bin/sh -c or cmd.exe /c start /b. No version pin, no hash/signature verification. Additional obfuscation is present in sibling lib/telemetry.js (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]), and the behavior is framed as analytics/telemetry with a cosmetic DISABLE_TELEMETRY env-var opt-out. Installing or requiring this package yields full-host code execution under the installer's account from attacker-controlled infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-independent-bnpl-main-title"},"versions":["35.6.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"c384b4c408049d63e60fb3b97ee64a305400e9f28a8adc55dd6301927b4e67c7","tlsh":"3da195aa057a70184b70d7e5c6176416f55bf6633280c5d4fa9ca5980fb6124c3b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-main-title-35.6.7.tgz","hashes":{"sha1":"cb7d23917f082f301e069bb0ab690cf9a1ba8016","sha512_sri":"sha512-HxdsTUGAP6qvKSURvPRJLVMQVm8F1addm4a/7+WHTsNi5XaF6PZMdlhyfSNZWBkL/SWuN8oGUnwEqWZLquF3gw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-main-title/v/35.6.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015423","import_time":"2026-08-05T15:19:50.582452447Z","modified_time":"2026-08-05T14:44:33Z","sha256":"85d01515b559e3e623341b5838615add9439fc1d3942948acb3ca2aee86e9579","source":"amazon-inspector","versions":["35.6.7"]}]}}