bnpl-blocks-independent-bnpl-text-block

{"modified":"2026-08-05T14:42:59Z","published":"2026-08-05T14:42:59Z","schema_version":"1.7.4","id":"MAL-2026-12972","summary":"Malicious code in bnpl-blocks-independent-bnpl-text-block (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6bc1ec9ae3c3510564b412ad20157f80b59ebe816ceda37ee01a3a46fd146b3f)\nOn require of this package, index.js loads _compat.js which unconditionally bootstraps a dropper. It selects a platform-specific payload path, fetches an opaque executable from one of three Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed. Destination hostnames are reconstructed at runtime by joining fragmented string arrays (e.g. ['sdk.dl.','wel1','.ru'].join(''), ['oob-worker.cf102-','baf.','work','ers','.d','ev'].join('')), and the dropped-file names impersonate benign diagnostic tooling (dotnet_diag). A stale-marker gates re-execution across imports.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-independent-bnpl-text-block"},"versions":["35.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"20f5ce21482475537c5e7a126bb90acbabf0d12068bd7235b13096199a69bdb2","tlsh":"64b1946a16a570188bb0d7e5c7176415f55af263378091d8fa9ca9880ff2124c3b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-text-block-35.7.1.tgz","hashes":{"sha1":"d2a0ace390a91422c63fe7c832a48adc4cc76864","sha512_sri":"sha512-5g9VrgLIYOnDWK8/q5ZLuVoZmVz7vsDnWBbRDVjR0gF4MLKiG6thR6ooAomy8NUwH+irysYfjraYibckz69NqQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-text-block/v/35.7.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015412","import_time":"2026-08-05T15:19:50.009279371Z","modified_time":"2026-08-05T14:42:59Z","sha256":"6bc1ec9ae3c3510564b412ad20157f80b59ebe816ceda37ee01a3a46fd146b3f","source":"amazon-inspector","versions":["35.7.1"]}]}}