bnpl-blocks-mobile-bnpl-title

{"modified":"2026-08-05T14:36:57Z","published":"2026-08-05T14:36:57Z","schema_version":"1.7.4","id":"MAL-2026-13010","summary":"Malicious code in bnpl-blocks-mobile-bnpl-title (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5cf4f269562c9f3d9dd234e8c38b6d3408b636a4e743a6106dff730efce473ce)\nOn require of the package, index.js loads _support.js, which selects a per-platform binary path, downloads bytes from a pool of obfuscated Cloudflare Workers mirrors whose hostnames are reassembled at runtime from split string fragments (e.g. oob-worker.cf103-070.workers.dev), writes the payload to a disguised temp filename such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods 0755 on POSIX, and spawns it detached via cmd.exe /c start /b or /bin/sh -c '<path> &'. If HTTPS mirrors fail, a fallback covert channel resolves DNS TXT records under *.dl.wel1.ru, reassembles a base64-encoded executable from chunked TXT responses, and executes it the same way. No hash or signature check is performed. Hostnames are hidden via split-and-join to evade static inspection. The combination of import-time execution, unpinned remote payload, non-publisher hosts with obfuscated names, DNS-over-TXT payload transport, and detached background spawn is a full-host remote code execution channel against the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-mobile-bnpl-title"},"versions":["35.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_support.js","sha256":"21a0e5033a0dfd87e8c749107fbd792592c48016f8f18a2605685f8273e7cc0c","tlsh":"36a1a59a15aa30184bb097e4cb174416fa5bf6a33380c2d4f76ca5841fb252483b2ffc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-title-35.7.1.tgz","hashes":{"sha1":"4be48e755540272cac0c1157bfb4a71169abdff2","sha512_sri":"sha512-V5XcY8PqAk0gV9Qh12GJMXXAbRZ0vf0ql1caZMLy2IuG4UUfNPu50aoYU1D+2iVJDhMKYg8rqWcPymkY2EGRhQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-title/v/35.7.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015371","import_time":"2026-08-05T15:19:47.625924579Z","modified_time":"2026-08-05T14:36:57Z","sha256":"5cf4f269562c9f3d9dd234e8c38b6d3408b636a4e743a6106dff730efce473ce","source":"amazon-inspector","versions":["35.7.1"]}]}}