bnpl-blocks-mobile-bnpl-category-gallery

{"modified":"2026-08-05T14:41:32Z","published":"2026-08-05T14:41:32Z","schema_version":"1.7.4","id":"MAL-2026-12984","summary":"Malicious code in bnpl-blocks-mobile-bnpl-category-gallery (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c3b498a386a4aeab43aedc022880d8bf90e2d8feb2cc94bafe313fa73c09b4b1)\nOn any require() of this package, index.js loads _loader.js, which reconstructs destination hostnames at runtime from array-join fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, with DNS-TXT fallbacks under *.dl.wel1.ru), downloads a platform-specific binary from those hosts, writes it to /tmp or %TEMP% under masquerading filenames such as dotnet_diag_*.exe or.cache_*, chmods it 0755, and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}) or spawn(\"cmd\",...). A second, parallel dropper is bundled in lib/telemetry.js: a base64-decoded payload buffer is written, chmod'd 0755, and executed via detached /bin/sh. child_process and hostname strings are assembled with require(\"child_\"+\"process\") and [...].join(\"\") to evade static analysis. The opaque remote payload has no hash or signature verification and originates from non-publisher Cloudflare Workers infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-category-gallery"},"versions":["35.6.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"bb3c191b537f6069946bc2be91e70a06b7c1761a3fccae2987b87ba02782e4c1","tlsh":"d3a18696166670194bb0d7e487178416f65bf6533380c284f79ca9985f7722483b2efc"},{"path":"lib/telemetry.js","sha256":"9b3fd4a4354d413af7ea1642cb32fec288255e76471e96b002d2e8511f7ecda5","tlsh":"27835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-category-gallery-35.6.5.tgz","hashes":{"sha1":"b6e63e6b051a46c6d21fc6129fe94bc6e93aead8","sha512_sri":"sha512-KfhxvuCOdJRKzVK0kpJuCGZ3uS2VQW2Y/U5hXyBsUI9Ln9eDIiDX8WTDoWN8yKvhjW4D5tIg4rP9hvfUm2AV0Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-category-gallery/v/35.6.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015402","import_time":"2026-08-05T15:19:49.430773718Z","modified_time":"2026-08-05T14:41:32Z","sha256":"c3b498a386a4aeab43aedc022880d8bf90e2d8feb2cc94bafe313fa73c09b4b1","source":"amazon-inspector","versions":["35.6.5"]}]}}