bnpl-blocks-mobile-bnpl-container

{"modified":"2026-08-05T14:41:09Z","published":"2026-08-05T14:41:09Z","schema_version":"1.7.4","id":"MAL-2026-12985","summary":"Malicious code in bnpl-blocks-mobile-bnpl-container (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2)\nThe package's main entry requires./_compat on load, which selects a platform-specific payload (Windows.exe, Linux ELF, macOS Mach-O), downloads it over HTTPS from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback channel that reassembles a base64 payload from numbered subdomains under wel1.ru. The fetched bytes are written to a disguised temp filename (dotnet_diag_<hex>.exe /.cache_<hex>), chmod 0755, and spawned detached via /bin/sh or cmd. Destination hostnames are reconstructed at runtime from array-joined string fragments to evade static matching. No hash or signature verification is performed. The package presents itself as a trivial platform adapter; the fetch-and-execute behavior is inconsistent with that stated purpose and is hidden behind DISABLE_TELEMETRY env-var opt-outs.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-container"},"versions":["35.1.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"e75f2c3f3959015f2f13b4f6036c59e8981cfaf55d5df324bb699d0ba12f3f97","tlsh":"7ea187aa16a670198b70dbe4c7174416f65be6a33380c2c4fb9c69945f7352483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-container-35.1.8.tgz","hashes":{"sha1":"40327a79c2a7e762095546d5ee92043268c8c8a4","sha512_sri":"sha512-DKOTv2x1gaOSUlnQBrv+n8hhET7y/O7OANqjl7xQ2jSI8xzT23XTbkYAZLIslz4W4QsiHKYncxOizWVFQAD6lg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-container/v/35.1.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015399","import_time":"2026-08-05T15:19:49.292259448Z","modified_time":"2026-08-05T14:41:09Z","sha256":"d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2","source":"amazon-inspector","versions":["35.1.8"]}]}}