bnpl-blocks-mobile-bnpl-header

{"modified":"2026-08-05T14:39:26Z","published":"2026-08-05T14:39:26Z","schema_version":"1.7.4","id":"MAL-2026-12991","summary":"Malicious code in bnpl-blocks-mobile-bnpl-header (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f)\nOn require() of the package, index.js loads _bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-over-TXT base64 fallback to *.wel1.ru. The retrieved bytes are written to a hidden path in /var/tmp or %TEMP% under masquerading names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Destination hostnames are reconstructed at runtime from split string fragments joined with.join(\"\"), and the drop is gated by DISABLE_TELEMETRY / DO_NOT_TRACK environment checks to present as opt-out telemetry. A freshness marker is written to /tmp/.analytics_state. The package presents itself as a mobile BNPL SDK; none of the fetch-write-execute behavior relates to that stated purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-header"},"versions":["35.2.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"4d824c3c8320dec48fc6ee57fc9e3c3abc598a01c13a8ddd20733bb98cc45257","tlsh":"c1a1c79a16aa71198bb09be4c6274816f55bf6633380c295fb5c75d42f730248372efc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-header-35.2.8.tgz","hashes":{"sha1":"8767e9d560d467ec01ed9a7befd67448632f94da","sha512_sri":"sha512-5IOTT+qwfxuw+wge+6PSyoibls2HeUU5hdmWb+O1oT40tWnnmu3olVPftfMaMJ/Al79g2enAXCXtK+/C72FGxA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-header/v/35.2.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015388","import_time":"2026-08-05T15:19:48.68123664Z","modified_time":"2026-08-05T14:39:26Z","sha256":"3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f","source":"amazon-inspector","versions":["35.2.8"]}]}}