bnpl-blocks-mobile-bnpl-button-set

{"modified":"2026-08-05T14:40:20Z","published":"2026-08-05T14:40:20Z","schema_version":"1.7.4","id":"MAL-2026-12981","summary":"Malicious code in bnpl-blocks-mobile-bnpl-button-set (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d860ca2d011c1e76bfee65b763f4a2d612dfad059ebbde41bb8cb79bc5680808)\nOn require() of the package, _init.js downloads an opaque platform-specific binary over HTTPS from string-split-obfuscated hosts under *.workers.dev (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS TXT covert-channel fallback that reads chunked base64 payload from c./0../N. subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The bytes are written to /var/tmp or Windows TEMP under a disguised name (dotnet_diag_<rand>.exe,.cache_<rand>), chmodded 0755, and detached-spawned via /bin/sh -c or cmd.exe. Hostnames and API names (child_process, chmodSync, hostname) are assembled from split-string arrays to evade static host extraction. A cooldown stampfile and opt-out env vars gate re-execution. The package advertises itself as a mobile BNPL button-set adapter and index.js is a trivial class stub, so the fetched binary is unrelated to the declared purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-button-set"},"versions":["35.6.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_init.js","sha256":"7f51864bc4de2b7240ef1f10259898994cd85a2a346e848c6875a24035690795","tlsh":"85a18596166a70184bb09be4c717442af95bf56337809294fb9c69981f7213483f2efc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-button-set-35.6.5.tgz","hashes":{"sha1":"4cee3254435e54c5789d8981aa43567e362df58d","sha512_sri":"sha512-ZRldNu4kRhyWvxwEHTSp3Q9xF2ssXR2y34fWKvinNUsP6ZTuHLNvaS9Y47TK2j42M+Wn2+UnVybVuzo9vGmesQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-button-set/v/35.6.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015394","import_time":"2026-08-05T15:19:48.982409679Z","modified_time":"2026-08-05T14:40:20Z","sha256":"d860ca2d011c1e76bfee65b763f4a2d612dfad059ebbde41bb8cb79bc5680808","source":"amazon-inspector","versions":["35.6.5"]}]}}