bnpl-blocks-independent-bnpl-tiles

{"modified":"2026-08-05T14:42:32Z","published":"2026-08-05T14:42:32Z","schema_version":"1.7.4","id":"MAL-2026-12973","summary":"Malicious code in bnpl-blocks-independent-bnpl-tiles (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a)\nOn require() of this package, index.js loads _adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split character arrays (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, cf103-070/cf99-9b3/cf102-baf.workers.dev and.ru fallbacks sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), fetches an opaque binary over HTTPS, writes it to a temp path under a cover-story name (dotnet_diag_<hex>.exe /.cache_<hex>), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT covert channel fetches a base64-chunked payload via numbered TXT records when HTTPS is blocked. The host strings are split into arrays and rejoined at runtime to defeat static inspection, and no hash or signature verification is performed on the fetched bytes. Import (require/load) of the module triggers the download-and-execute path unconditionally, giving remote code execution on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-independent-bnpl-tiles"},"versions":["35.8.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"84eff7e8bb316cc129cdc61d81c5b52b7d74ed7f60b412fb3ff15cf0365fd86a","tlsh":"dba1979616a670184bb09be4c727481af55bf76333c0c298fb5ca5981f7212482b1dfc"}],"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-tiles-35.8.9.tgz","hashes":{"sha1":"a9b3c2606c7590afe1e73f2abe45a8e4cca64ab2","sha512_sri":"sha512-hfB6kQOs61BO5ehs2SBaFGXUK+FregYsioSvhzDJGXH7pgkGsamS+kCAhAmo4nzR1yFH4AlVIA+lGnc1qEM9EA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-tiles/v/35.8.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015409","import_time":"2026-08-05T15:19:49.853454075Z","modified_time":"2026-08-05T14:42:32Z","sha256":"56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a","source":"amazon-inspector","versions":["35.8.9"]}]}}