{"id":"MAL-2026-12892","summary":"Malicious code in bnpl-blocks-atom-bnpl-search-input (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4f6cce4434c5b69e3ce6547672267cf91a8d243e9970fe13b9b669e7f7a7b91b)\nOn require, _bridge.js fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) and wel1.ru subdomains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), with a DNS-TXT reassembly fallback. The payload is written to /tmp or %TEMP% under disguised names (dotnet_diag_\u003crand\u003e.exe on Windows,.cache_\u003crand\u003e on Unix), chmodded 0755, and spawned detached via cmd.exe or /bin/sh. Destinations are assembled from split string arrays to evade static analysis, and a marker-file cache plus DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK opt-out gates hide re-execution. The package advertises itself as an unrelated 'search input SDK', so the fetched binary has no relationship to the declared purpose. Loading the module in any consumer executes attacker-controlled native code on the installer's host.\n","modified":"2026-08-05T15:50:45.462488604Z","published":"2026-08-05T14:54:00Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:54:00Z","sha256":"4f6cce4434c5b69e3ce6547672267cf91a8d243e9970fe13b9b669e7f7a7b91b","source":"amazon-inspector","versions":["35.9.7"],"id":"IN-MAL-2026-015487","import_time":"2026-08-05T15:19:53.966468392Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-search-input/v/35.9.7"}],"affected":[{"package":{"name":"bnpl-blocks-atom-bnpl-search-input","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-atom-bnpl-search-input"},"versions":["35.9.7"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"_bridge.js","sha256":"53650641b9db0c9ad383966e2164498d572a34a96101ec30ff48af9e551dc83d","tlsh":"e5a1b79a06aa70198bb0dbe187275415f56be6633380c190fb5ca9941fb7134c372efc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-bnpl-search-input-35.9.7.tgz","hashes":{"sha1":"b729f92582e6ec52df5f5f209ee2f9c258e80d4e","sha512_sri":"sha512-VCKBYjBC79w0jEgMiIxSHUV+0QIt3ztQwXENj91qtk1bNT6iajb/6mWYVLhdy6KPHx0xjnfwKeNYs22VWVBP2w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-search-input/MAL-2026-12892.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}