bnpl-blocks-independent-bnpl-scheme

{"modified":"2026-08-05T14:42:23Z","published":"2026-08-05T14:42:23Z","schema_version":"1.7.4","id":"MAL-2026-12968","summary":"Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149)\nThe package ships a loader (_loader.js) that assembles remote hostnames at runtime from string-split arrays (reconstructing subdomains of wel1.ru and a cloudflare workers.dev host) to evade static detection, issues an https.get to those endpoints, writes the response to disk, chmods it executable (0755), and spawns it via /bin/sh -c or cmd. A sibling module lib/telemetry.js (~81KB) presents itself as an 'analytics SDK' but contains the same dropper primitives (base64 chunk decode, chmodSync 0755, cp.spawn('/bin/sh',['-c', filePath+' &'])). Hostname reconstruction via array split/join combined with a fetch-write-chmod-exec chain is an obfuscated remote code delivery mechanism, not legitimate SDK behavior. The runtime-assembled destinations do not match any documented publisher endpoint, and the code path is reachable on load. Installing or loading this package results in execution of attacker-controlled code fetched from wel1.ru subdomains and a *.workers.dev host on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-independent-bnpl-scheme"},"versions":["35.8.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"d7f158dcfbf7377dea7dbd0b77466ff806772abc356614cf3dcdd73c9bc2fc8e","tlsh":"12a1979a166a70194bb0dbe0872b541af656f6633380c1c4fb5ca5944f771248272efc"},{"path":"lib/telemetry.js","sha256":"8e705dcc15b2319623e9bc6cee0f7d5fe8a19224b44cf5048549e99f0ecb4dfd","tlsh":"57835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-scheme-35.8.4.tgz","hashes":{"sha1":"8e6b73dc92677238037f0f4a7a7c22aad2c44b83","sha512_sri":"sha512-afowgPyJ5RxGR6t7mxT33bScIePznNrYX63B67FGeJ4rNToQBl7UF5ipETDsJACbjBx+u63RaPdTq4iz0/8+Zw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-scheme/v/35.8.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015408","import_time":"2026-08-05T15:19:49.751412755Z","modified_time":"2026-08-05T14:42:23Z","sha256":"386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149","source":"amazon-inspector","versions":["35.8.4"]}]}}