bnpl-blocks-mobile-bnpl-faq

{"modified":"2026-08-05T14:41:17Z","published":"2026-08-05T14:41:17Z","schema_version":"1.7.4","id":"MAL-2026-12987","summary":"Malicious code in bnpl-blocks-mobile-bnpl-faq (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e6a2921266e52f201547a9cd08fabd37f291c1db3c02e22c6b546206dfb9c20d)\nOn require() of this package, index.js loads _adapter.js which invokes bootstrap() at module load. The code selects a platform-specific endpoint, assembles hostnames from string-split arrays (e.g. [\"oob-worker.cf100-\",\"416.wo\",\"rkers.d\",\"ev\"].join(\"\")) to resolve to anonymous Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), fetches an opaque binary via https.get, writes it to /var/tmp or %TEMP% under disguised names (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows to masquerade as dotnet diagnostics), chmods 0755, and spawns it detached with stdio ignored via cp.spawn(\"/bin/sh\",[\"-c\", fp+\" &\"], {detached:true, stdio:\"ignore\"}).unref(). A fallback covert channel reassembles the payload from base64-encoded chunks stored in DNS TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (reading a chunk count from c.<domain> then concatenating <n>.<domain> TXT responses) to bypass HTTP egress filtering. No hash or signature verification is performed on the fetched bytes. Cover-story comments (\"Clean up temporary files\", \"Shuffle endpoints to distribute load\", \"Initialize session tracking state\") and a stamp file named.analytics_state present the behavior as telemetry; opt-out environment variables DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK short-circuit the dropper, functioning as an evasion switch. The package's declared purpose is a generic \"platform adapter\" with no legitimate need for a native runtime.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-faq"},"versions":["35.5.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"ada4a3788edcd450944f2536f456b4aa397acd8c570c4d9021db08f09705361c","tlsh":"31a1a76a05a670194bb0dbe4c6175416f55ae66337c0c298f79c69dc1fb212482f3eec"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-faq-35.5.3.tgz","hashes":{"sha1":"94f314be8f293a7c6b8d8a4ddde51de15b5508d6","sha512_sri":"sha512-0VKprjyNmcbarXfWzFPBO8zPZ6rntV+nt8SwGr1KM/0L5NAJM963IPxJa4M5s5nlStYsipL9nYda//RV8u9tig=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-faq/v/35.5.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015400","import_time":"2026-08-05T15:19:49.339080421Z","modified_time":"2026-08-05T14:41:17Z","sha256":"e6a2921266e52f201547a9cd08fabd37f291c1db3c02e22c6b546206dfb9c20d","source":"amazon-inspector","versions":["35.5.3"]}]}}