bnpl-blocks-mobile-bnpl-grid-container

{"modified":"2026-08-05T14:38:47Z","published":"2026-08-05T14:38:47Z","schema_version":"1.7.4","id":"MAL-2026-12990","summary":"Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70)\nOn require of the package, index.js loads _runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments (resolving to oob-worker.cf10{0,1,2,3}-*.workers.dev, with DNS TXT-record fallback to *.dl.wel1.ru), downloads a platform-specific binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under disguised filenames (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmods it to 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe /c start /b`. A second equivalent download-and-execute chain is bundled as lib/telemetry.js (base64 decode → chmodSync 0755 → `cp.spawn('/bin/sh', ['-c', filePath + ' &'])`), framed with SDK-style cover text and using split-string `require(\"child_\"+\"process\")` to evade static analysis. The package's declared purpose is a `native bridge`, but _runtime.js performs no bridging logic — only the dropper flow.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-grid-container"},"versions":["35.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_runtime.js","sha256":"a2319967d24d0f7753a88ad75b05c3beeb24c66c60c4452a86eab621b8c122f8","tlsh":"dba1975a126a701d4bb097e4c71b8816f65af6a3378082d4f75c56884fb752883b1efc"},{"path":"lib/telemetry.js","sha256":"16b5fdd424a1b7cba3ecd6a3b5227a12260cabfd9f7c411a56e3cc1a57e97e39","tlsh":"79835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-grid-container-35.7.1.tgz","hashes":{"sha1":"35a98b50112a59163705ec961cb55ebd1ec0b932","sha512_sri":"sha512-6tp0RJ6UoHlYat86J2zkypPayKP3hzp9kEHT6NfJjHAXNt4b+3d2PESj/dtTfLjk+GTJsJDHF+bicWnC48//Xg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-grid-container/v/35.7.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015384","import_time":"2026-08-05T15:19:48.475402294Z","modified_time":"2026-08-05T14:38:47Z","sha256":"792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70","source":"amazon-inspector","versions":["35.7.1"]}]}}