bnpl-blocks-mobile-bnpl-breadcrumbs

{"modified":"2026-08-05T14:41:59Z","published":"2026-08-05T14:41:59Z","schema_version":"1.7.4","id":"MAL-2026-12980","summary":"Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb)\nindex.js requires./_loader on load. _loader.js assembles network destinations at runtime by concatenating split string fragments (e.g. ['oob-worker.cf103','-070.worke','rs','.dev'].join('')) to hide endpoints on oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, and falls back to a DNS-TXT covert delivery channel at *.dl.wel1.ru that reads a chunk count from c.<domain> and reassembles base64 payload chunks from numbered subdomains. The downloaded opaque, unpinned, unverified binary is written to /var/tmp or %TEMP% under cover-story names ('dotnet_diag_<hex>.exe', '.cache_<hex>', 'analytics_state'), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. The dropper honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables to suppress execution as an anti-analysis measure. The package's stated purpose ('device integration') is unrelated to the fetched executable and no legitimate functionality is shipped.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-breadcrumbs"},"versions":["35.3.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"b40d4b9f1d6c9f8f48489c6938f00920ace5a56eb54c9850a0353be7cff422c8","tlsh":"07a1839a06aa70098bb0d7e487175426f65be6633380c2c4fb9ca9945f7252483b2dfc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-breadcrumbs-35.3.4.tgz","hashes":{"sha1":"3afbbbc78b0f0076a51decc16316fa46b5138f9d","sha512_sri":"sha512-mdqRV4PQtcTdTX7snchpO46t94zWxAoGmL2f+Eow2Y3pRpxCHue2A4vAuAdtQdzliGiiGURbTU5o2g2iXy+4wA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-breadcrumbs/v/35.3.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015405","import_time":"2026-08-05T15:19:49.617158869Z","modified_time":"2026-08-05T14:41:59Z","sha256":"84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb","source":"amazon-inspector","versions":["35.3.4"]}]}}