{"id":"MAL-2026-12545","summary":"Malicious code in checkout-bnpl-logic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e)\nThe package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with `require(\"./_polyfill\")`, which runs on every consumer import. _polyfill.js reassembles hostnames from string arrays at runtime, fetches a platform-specific binary from anonymous Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a base64-over-DNS-TXT fallback channel through *.dl.wel1.ru (sdk/ext/pkg/net.dl.wel1.ru), writes the opaque bytes to a hidden temp path (/tmp/.cache_\u003chex\u003e or %TEMP%/dotnet_diag_\u003chex\u003e.exe), chmods 0755, and spawns it detached via `spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}).unref()` (or the cmd equivalent on Windows), with stderr silenced. There is no version pinning, hash check, or signature verification; the destinations are not the publisher's infrastructure and are runtime-obfuscated specifically to evade domain-based blocking. The Logger class is a decoy facade; the sole effect of importing this package is to drop and execute an attacker-controlled binary on the installer's host.\n","modified":"2026-08-05T14:35:10.301354965Z","published":"2026-08-05T14:15:08Z","database_specific":{"malicious-packages-origins":[{"versions":["35.9.2"],"id":"IN-MAL-2026-015226","import_time":"2026-08-05T14:20:14.63843203Z","modified_time":"2026-08-05T14:15:08Z","sha256":"cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/checkout-bnpl-logic/v/35.9.2"}],"affected":[{"package":{"name":"checkout-bnpl-logic","ecosystem":"npm","purl":"pkg:npm/checkout-bnpl-logic"},"versions":["35.9.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_polyfill.js","sha256":"cc00f4cf3d5b86e954ea6703a29b29798180cb9c74b68354f13773eb553428d8","tlsh":"92b1b89a166a701987b097e4c72b5416f65bf663338092d4fb6c95980fb31248372efc"},{"tlsh":"6c119b6267ed16475172a364cde380037a2ad29ea853b2dc734c53fe0fbd5581625e32","path":"index.js","sha256":"3918e4317632da3f118859ef6899963cb2a53356e3d534170b0ad077aceb5ef6"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-ii3zNoOWKXizajPPxS3SOdgFmgPMe/1lyTXEPTnfTJSmiPJ4OzhH5bVYYPtloOKZeblzXABuOwwcoDvqVSHtIQ==","sha1":"37b9b29d651921c6024424121f0676868530658a"},"filename":"checkout-bnpl-logic-35.9.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/checkout-bnpl-logic/MAL-2026-12545.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}