bnpl-blocks-playwright

{"modified":"2026-08-05T14:36:49Z","published":"2026-08-05T14:36:49Z","schema_version":"1.7.4","id":"MAL-2026-13012","summary":"Malicious code in bnpl-blocks-playwright (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b85856c1395372c88e148fdabb77be27f0556ad68ba3eb7f5c62d063a9154607)\nOn require('bnpl-blocks-playwright'), index.js loads _bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf10{0,1,2,3}-*.workers.dev, reassembled via array.join('')) with DNS TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_*.exe,.cache_*), chmod 0755s it on Unix, and spawns it detached via /bin/sh -c or cmd.exe. Hostnames and API identifiers (child_process, chmodSync) are split-concatenated at runtime to evade static analysis. The package is advertised as a Playwright/BNPL adapter and has no legitimate need to fetch and execute native binaries from anonymous Cloudflare Workers subdomains on import.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-playwright"},"versions":["35.4.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"2e9a4c47e83f88b81d3f00aad0a34f6c0947556552ed19ef849909a35319c675","tlsh":"24a1955a166a70084b709be4c61b4426f65bf6633781d2d4f79c69940fb313483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-playwright-35.4.6.tgz","hashes":{"sha1":"3ddc0597fc071acc71691ae8533ed92df0dcbf3a","sha512_sri":"sha512-ELraMGjR/aoyI8Q0LPTcBkcwjHmNftcozw2PGiRjFWqhrHRSKrVRvNQq1gq6758hkMtPIP30awjl1jRKTEWTFA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-playwright/v/35.4.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015370","import_time":"2026-08-05T15:19:47.598982271Z","modified_time":"2026-08-05T14:36:49Z","sha256":"b85856c1395372c88e148fdabb77be27f0556ad68ba3eb7f5c62d063a9154607","source":"amazon-inspector","versions":["35.4.6"]}]}}