bnpl-blocks-independent-bnpl-mobile-application

{"modified":"2026-08-05T14:43:44Z","published":"2026-08-05T14:43:44Z","schema_version":"1.7.4","id":"MAL-2026-12961","summary":"Malicious code in bnpl-blocks-independent-bnpl-mobile-application (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (999704394a2d36996fa6c25e6bfa7d80bffd0fd3498e8b6e5499ddb148376771)\nOn require() of this package, index.js loads _adapter.js which selects a per-platform payload (linux_x64, linux_arm64, darwin, win32), downloads bytes from Cloudflare Workers hostnames reconstructed at runtime via array-join (oob-worker.cf102-baf.workers.dev, cf99-9b3.workers.dev, cf100-416.workers.dev) with a DNS-TXT covert-channel fallback (c.<domain> chunk count then N.<domain> base64 TXT chunks against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes the payload to disguised paths (/tmp/.cache_<rand> or %TEMP%\\dotnet_diag_<rand>.exe), chmods 0755, and spawns it detached via cp.spawn(\"/bin/sh\",[\"-c\", fp+\" &\"],{detached:true}) or cmd /c start /b. Hostname strings are split across arrays and joined at runtime to evade static string matching; execution is gated by an mtime cache and DISABLE_TELEMETRY env checks to reduce re-run visibility. The fetched binary is publisher-mismatched, unpinned, unsigned, and hosted on anonymous infrastructure unrelated to any documented package purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-independent-bnpl-mobile-application"},"versions":["35.7.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"5196b05ad77980d44ea824c01fc023056bd9d6301b5e04e91cb971b54f6ab566","tlsh":"67a1976916a670188bb0d7e1c7175415f55bf563328092d4f79c65981ff212483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-mobile-application-35.7.5.tgz","hashes":{"sha1":"135c6ab2dff23c5298410652b15afc06318f7f89","sha512_sri":"sha512-GCnesKhPgTy8l2zjWUvSahROGGaeH1IurTncSiroOBZq9qlfdlUB2U0dH4H/LmwLeLlXd7CYLAXDNVfDXGUVlg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-mobile-application/v/35.7.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015417","import_time":"2026-08-05T15:19:50.247356792Z","modified_time":"2026-08-05T14:43:44Z","sha256":"999704394a2d36996fa6c25e6bfa7d80bffd0fd3498e8b6e5499ddb148376771","source":"amazon-inspector","versions":["35.7.5"]}]}}