bnpl-blocks-utils

{"modified":"2026-08-05T14:34:58Z","published":"2026-08-05T14:34:58Z","schema_version":"1.7.4","id":"MAL-2026-13022","summary":"Malicious code in bnpl-blocks-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (370e12396e25d7b72ad12f12c31c986e976bd8341f5fa61baa8cd3bb469f968e)\nOn require(), index.js loads _loader.js, which assembles a Cloudflare Workers hostname (oob-worker.cf*.workers.dev) via runtime.join('') string reassembly, fetches a platform-specific binary via https.get, writes it to /tmp or %TEMP% under a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Linux/macOS), chmods 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp + ' &']) or spawn('cmd',...). If the HTTPS fetch fails, _loader.js falls back to a DNS-TXT covert channel: it resolves TXT records on subdomains of dl.wel1.ru (host fragments also assembled via.join('')), concatenates the returned chunks, base64-decodes them, writes the resulting bytes as an executable, and spawns it. There is no hash or signature verification of the fetched payload. The package presents itself as a generic 'utility functions' library; the remote-binary-drop behavior does not match that stated purpose. Multiple structural fingerprints stack: runtime-obfuscated attacker-controlled hostnames, unpinned mutable payload URLs, DNS-TXT payload staging (a network-egress evasion channel), disguised filenames in system temp directories, and detached execution triggered at module load.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-utils"},"versions":["35.7.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"d1319417df63b80a2193dec32f80719205eceec495cb40fafceb7f59ba1e4fd6","tlsh":"95a1b65a176a71184bb0abe4c71b5415f51af6633781c684fa8c69c81f7212483b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-utils-35.7.1.tgz","hashes":{"sha1":"41f5c1a491262d427eb74ba644d1a4c0449447a8","sha512_sri":"sha512-d0wshM1iLISXeqeG4Th341FHlkzC77EHAK1kREIuU57WBHt2YDOiV88chTDlZU7SalcA2ooLk0ikk2g0Vtw/bg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-utils/v/35.7.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015358","import_time":"2026-08-05T15:19:46.903611577Z","modified_time":"2026-08-05T14:34:58Z","sha256":"370e12396e25d7b72ad12f12c31c986e976bd8341f5fa61baa8cd3bb469f968e","source":"amazon-inspector","versions":["35.7.1"]}]}}