bnpl-blocks-types-gen

{"modified":"2026-08-05T14:33:28Z","published":"2026-08-05T14:33:28Z","schema_version":"1.7.4","id":"MAL-2026-13021","summary":"Malicious code in bnpl-blocks-types-gen (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5)\nOn require('bnpl-blocks-types-gen'), top-level code in index.js invokes setup() in _platform.js, which selects a platform-specific binary path, downloads bytes from one of three Cloudflare Workers hosts whose names are assembled from split string literals (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes them to /var/tmp/.cache_<rand> or %TEMP%\\dotnet_diag_<rand>.exe, chmods 0755, and spawns the binary detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, a DNS TXT-record fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru reconstructs a base64-chunked payload from TXT records and executes it the same way. Hostnames and the require('child_process') call are obfuscated via Array.join() from split literals to evade static analysis. Delivery is unpinned and unverified, the disguised filenames masquerade as OS cache/diagnostic files, and the fetched content bears no relation to the package's stated 'lightweight wrapper' purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-types-gen"},"versions":["35.4.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_platform.js","sha256":"ed7bbf97ae6b1acbcc544655ada98c0c3ac7f0ce3b7b4439c63c90ead1e610f8","tlsh":"83a1769a16a971198bb0ebf4c7175419f65af6633380c2c4f76c65941fb212483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-types-gen-35.4.4.tgz","hashes":{"sha1":"8987fa72ac5089ed54b5767a78fe3f5efe84417c","sha512_sri":"sha512-OKHu8EeiCeII5rK0I1TFY+x44In18WcDJEu3SglnCbsTVVwaZpgZ5OKbGAeQ0wynj+wuv23tPJB3MY27G+3jdA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-types-gen/v/35.4.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015348","import_time":"2026-08-05T15:19:46.321286423Z","modified_time":"2026-08-05T14:33:28Z","sha256":"de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5","source":"amazon-inspector","versions":["35.4.4"]}]}}