bnpl-blocks-stories-of-block

{"modified":"2026-08-05T14:35:51Z","published":"2026-08-05T14:35:51Z","schema_version":"1.7.4","id":"MAL-2026-13019","summary":"Malicious code in bnpl-blocks-stories-of-block (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121)\nOn require() of this package, index.js loads _bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of attacker-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a temp path with a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmods it to 0755, and spawns it detached via cmd.exe /c start or /bin/sh -c. Destination hostnames are reassembled at runtime via array split +.join(\"\") to evade static analysis, and child_process is required as require(\"child_\"+\"process\"). If the HTTPS mirrors fail, _bootstrap.js falls back to a DNS-TXT covert channel under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru): it queries a count record and N sequential TXT records, base64-decodes and concatenates them into an executable buffer, then writes and spawns it with no signature or hash verification. Cover-story naming (analytics_state marker, dotnet_diag_*.exe, DISABLE_TELEMETRY/DO_NOT_TRACK env opt-outs) does not alter that this is arbitrary remote code execution on the installer's host on module load.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-stories-of-block"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"ba36be5ecfdb147604c521aa222c6c09b58c8603c472377eacc4dd313a460954","tlsh":"beb1a69a12a670188bb0e7e4c71b8816f65bf6633391c284fb5ca5945f735248372efc"}],"package_integrity":[{"filename":"bnpl-blocks-stories-of-block-35.8.1.tgz","hashes":{"sha1":"e517a9934c61f3653974cbd37f357352bcca379e","sha512_sri":"sha512-bqSHFVTd0LTkEercSZjeSO4f9Q3XqAQIKGGOjZrhz9c8GqsYftW6N3gMw3K0HXtRWnIDV6+vjotGmrgkAK1CFQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-stories-of-block/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015364","import_time":"2026-08-05T15:19:47.215971959Z","modified_time":"2026-08-05T14:35:51Z","sha256":"a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121","source":"amazon-inspector","versions":["35.8.1"]}]}}