bnpl-blocks-atom-bnpl-checkbox

{"modified":"2026-08-07T12:27:36Z","published":"2026-08-07T12:27:36Z","schema_version":"1.7.4","id":"MAL-2026-13527","summary":"Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0)\nOn require() of the package main, _polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments (require(\"child_\"+\"process\"), array-join of hostname fragments), fetches a platform-specific binary payload via https.get from Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to a temp path under a disguised filename, chmods 0755, and spawns it detached via cp.spawn('/bin/sh',['-c', filePath+' &'],{detached:true}). No version pinning, no hash/signature verification, and destinations are unrelated to the package's advertised purpose. lib/telemetry.js contains a dormant second copy of the same drop-and-spawn shape (base64 chunk decoding, chmod 0755, detached /bin/sh spawn), currently unreachable from index.js. The 'analytics' framing and split-string obfuscation of both the child_process import and the hostnames are cover-story evasion of static analysis.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-atom-bnpl-checkbox"},"versions":["35.6.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"42f36a9e4fc18f0eb2347077c09c25ac2772a488a598ba2ef3122d9c52c28d91","tlsh":"2ea1b65a127630198bb0d7e4c7175416f66ae6633380c294fb9ca9985f7312483b2dfc"},{"path":"lib/telemetry.js","sha256":"e65d5e4911aa7e28c0a4fd310d658307d3f3a0ee4d39d9239d6b54a63eee02b1","tlsh":"7c835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-bnpl-checkbox-35.6.1.tgz","hashes":{"sha1":"67ece4fb3069c2d3f2d1eb8f8917f67e02debbd4","sha512_sri":"sha512-B506bWlNPOJeGZMDzPbnqYI8QoT/mxYXH2d2PpD6sKAgqpcSGf/EhCmdWO4dds1zlb2RCf6PU5p2IkfR2BoXGA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-checkbox/v/35.6.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016989","import_time":"2026-08-07T12:51:21.161255Z","modified_time":"2026-08-07T12:27:36Z","sha256":"3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0","source":"amazon-inspector","versions":["35.6.1"]}]}}