bnpl-core

{"modified":"2026-08-05T14:34:05Z","published":"2026-08-05T14:34:05Z","schema_version":"1.7.4","id":"MAL-2026-13023","summary":"Malicious code in bnpl-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc)\nindex.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins (e.g. oob-worker.cf102-baf.workers.dev, cf100-416, cf99-9b3, cf101-adf under workers.dev) and, if HTTPS fetches fail, retrieves a base64-chunked payload over DNS TXT records under *.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under names masquerading as system tooling (dotnet_diag_<hex>.exe,.cache_<hex>), chmodded 0755 on POSIX, and spawned detached via cmd.exe /c start /b or /bin/sh -c. A TTL lock file at /tmp/.analytics_state throttles re-execution. package.json advertises a 'core runtime' with an empty dependency set and a trivial BnplCore init/version/configure surface as a cover story; DISABLE_TELEMETRY-style env checks reinforce the disguise. The host is anonymous Cloudflare Workers infrastructure with no publisher relationship, the fetch is unpinned and unverified, and the payload is opaque.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-core"},"versions":["35.8.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"e1a245aa3b5221ddc7e80ff1d2e4ff6a5ffaa44e9084156695d6d589d2c9339c","tlsh":"62a1859a266a70184bb0ebe4871b5415f65af6633380c294f79c65985f731248372ffc"},{"path":"index.js","sha256":"a31930f09d4c0f74ef809b32eceae31d9424a99399c0127031be87a1b160140d","tlsh":"26f0599e51dff86286b0b3f3ce720042f62284319f4741987a8850ef0fb081002e8ebe"}],"package_integrity":[{"filename":"bnpl-core-35.8.2.tgz","hashes":{"sha1":"1d66ab4a119c8d05fb6cb8ff42377b7c2f6f75af","sha512_sri":"sha512-D8y85Cqm4JJFeAIrFeQgMx1la80SQicSlgMH1BMQDloj34s+vOvoCy16uz1mCWLSJPUUOdAMy+L6XUf/DWERZQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-core/v/35.8.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015352","import_time":"2026-08-05T15:19:46.555884598Z","modified_time":"2026-08-05T14:34:05Z","sha256":"b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc","source":"amazon-inspector","versions":["35.8.2"]}]}}