bnpl-blocks-mobile-bnpl-image-with-caption

{"modified":"2026-08-05T14:39:07Z","published":"2026-08-05T14:39:07Z","schema_version":"1.7.4","id":"MAL-2026-12994","summary":"Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805)\nOn require() of the package, index.js loads _polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three hardcoded workers.dev hosts (oob-worker.cf101-adf.workers.dev and siblings), with a DNS-TXT base64 chunked fallback via sdk.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a masquerading name (.cache_<rand> on POSIX, dotnet_diag_<rand>.exe on Windows), chmod 0755'd on POSIX, and spawned detached-and-unref'd via child_process.spawn(\"/bin/sh\", [\"-c\", path+\" &\"]) or spawn(\"cmd\",...). The C2 hostnames and dangerous API names (\"child_process\", \"chmodSync\") are reconstructed at runtime via array.join()/string concatenation to evade static analysis. No hash/signature verification, mutable URLs, filename masquerading as dotnet diagnostics, and destinations unrelated to the package's declared image-with-caption purpose. A sibling lib/telemetry.js reuses the same string-reconstruction anti-analysis shape.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-image-with-caption"},"versions":["35.3.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"952df818bc3d0c52bc25ac877e24aa6c1ecc98ae372be462f686d63de0698ddc","tlsh":"67b1b7a6166770184b71dbf1c2075415f65bf6632681c284fb9ca5881fb3124c2f2efc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-image-with-caption-35.3.6.tgz","hashes":{"sha1":"84759338fea7a50777f725f454b985f47886666e","sha512_sri":"sha512-D2rVqhiOKRmwykKHBefxkXCSkVpeIVqrev9KVQw9cWdeCzpNxQ+57KLzIoMyQL6YoUqKSLuJb4p7Tvs2zTn4mg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-image-with-caption/v/35.3.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015386","import_time":"2026-08-05T15:19:48.606830839Z","modified_time":"2026-08-05T14:39:07Z","sha256":"7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805","source":"amazon-inspector","versions":["35.3.6"]}]}}