bnpl-blocks-atom-bnpl-loader

{"modified":"2026-08-07T12:23:47Z","published":"2026-08-07T12:23:47Z","schema_version":"1.7.4","id":"MAL-2026-13530","summary":"Malicious code in bnpl-blocks-atom-bnpl-loader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e219aa368cf93296783647d204c970e9302c41fab778d953471f7ce905f3dfdc)\nOn any require/import of this package, index.js loads setup.js, which reassembles four `oob-worker.cf*.workers.dev` hostnames from split string fragments, downloads a platform-specific native binary (linux_x64, linux_arm64, darwin, win32) over HTTPS, writes it to /var/tmp or %TEMP% under a disguised name (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows masquerading as a.NET diagnostic tool), chmods it 0755, and spawns it detached via `cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` / `spawn('cmd',...)`. If HTTPS is blocked, a covert DNS-TXT fallback chunks a base64-encoded payload from `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, and `net.dl.wel1.ru`. Destination hostnames and.ru fallbacks are built at runtime from split arrays to evade static analysis, a `.analytics_state` cache stamp suppresses re-runs, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env-var checks provide a telemetry cover story. lib/telemetry.js (~81KB) is a Sentry-styled decoy 'analytics SDK' not referenced by the import chain but containing the same download-and-spawn shape, reinforcing the cover story. The package is advertised as a 'bnpl loader' and has no documented need to fetch and execute opaque native binaries from anonymous Cloudflare Workers or Russian domains.\n","affected":[{"package":{"ecosystem":"npm","name":"bnpl-blocks-atom-bnpl-loader"},"versions":["35.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"11a76cc8c5bc69881cd7d2b6c44947e75ae3bd116a538bdfed382eab038592d9","tlsh":"4ba1b75616aa70188bb0d7f4cb175416f65af6733380c684fb9c69985fb212483b2efc"},{"path":"lib/telemetry.js","sha256":"5397ab150d21b9bd66b912a7eaf43b7a95a18082763b14a52ff7e0bc2006d352","tlsh":"60835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-bnpl-loader-35.1.2.tgz","hashes":{"sha1":"8d27f14e215da704c8593403733c29266bcfcfb2","sha512_sri":"sha512-pmpWMPma8bwaOejKcWtHQ9oIcp9w9AriDclVkKkQCJzoPQ1o08tzTxfW9EHfnmRSDzNS999dJDi6ZsDPG7W88A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-loader/v/35.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016963","import_time":"2026-08-07T12:51:19.992761675Z","modified_time":"2026-08-07T12:23:47Z","sha256":"e219aa368cf93296783647d204c970e9302c41fab778d953471f7ce905f3dfdc","source":"amazon-inspector","versions":["35.1.2"]}]}}