bnpl-blocks-mobile-bnpl-article-author

{"modified":"2026-08-05T14:40:08Z","published":"2026-08-05T14:40:08Z","schema_version":"1.7.4","id":"MAL-2026-12979","summary":"Malicious code in bnpl-blocks-mobile-bnpl-article-author (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd)\nOn require of the package, index.js loads _shim.js which reconstructs a set of Cloudflare Workers hostnames (oob-worker.cf101-adf/102-baf/99-9b3/103-070.workers.dev) and DNS-TXT fallback domains (sdk/ext/pkg/net.dl.wel1.ru) from array fragments joined at runtime, downloads an opaque binary over HTTPS (with a DNS-TXT chunked base64 covert channel as fallback when HTTPS egress is blocked), writes it to /tmp or the Windows temp directory under disguised names such as.cache_<rnd> or dotnet_diag_<rnd>.exe, chmods it to 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. Destination hostnames are obfuscated via string-split-and-join to evade static detection. Installing or importing this package results in execution of attacker-controlled native code on the host with the installer's privileges.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-article-author"},"versions":["35.3.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_shim.js","sha256":"ae8124d0c7e15b913407412399669d912851d9c41d747e5a582b6cdcd4d7695a","tlsh":"2ea1a8aa156a701987b0d7f48717541af66bf6633380c6d4f75c59880f7312483b2eec"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-article-author-35.3.3.tgz","hashes":{"sha1":"9af38fd23c38b0fc12cd37114625069324577924","sha512_sri":"sha512-5RsqgDcqKo6PQHKMQvHtbqMYKg7Koa58S7QqOtVNtJua4z/G/K6WunzI0/U3H6P7H8UHEMwexsbqRAORoAoC0Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-article-author/v/35.3.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015393","import_time":"2026-08-05T15:19:48.945775438Z","modified_time":"2026-08-05T14:40:08Z","sha256":"1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd","source":"amazon-inspector","versions":["35.3.3"]}]}}