{"id":"MAL-2026-12908","summary":"Malicious code in bnpl-blocks-consts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede)\nPackage is advertised as a constants wrapper but requiring it loads _polyfill.js, which on import asynchronously downloads a platform-specific executable, writes it to /tmp (Unix) or the Windows TEMP directory under decoy names (dotnet_diag_\u003chex\u003e.exe,.cache_\u003chex\u003e,.analytics_state), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start (spawn calls at _polyfill.js lines 121 and 125; child_process required at line 119). Payload host list is assembled at runtime by split-join to defeat static string scanning, resolving to Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev. When HTTPS fetches fail, the code queries a DNS TXT chunk-count record at c.\u003cdomain\u003e and then loops through 0.\u003cdomain\u003e..N-1.\u003cdomain\u003e under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-concatenates the TXT payload, and executes the reconstructed binary. The dropper honors DO_NOT_TRACK / DISABLE_TELEMETRY environment variables to masquerade as telemetry. Purpose (a trivial constants module) is inconsistent with fetch-and-execute of an opaque binary from obfuscated hosts, and every distinguishing signal (host string-splitting, decoy artifact names, DNS covert-channel fallback, detached spawn) is characteristic of a supply-chain implant.\n","modified":"2026-08-05T15:50:53.309038459Z","published":"2026-08-05T14:51:16Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:51:16Z","sha256":"7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede","source":"amazon-inspector","versions":["35.1.9"],"id":"IN-MAL-2026-015468","import_time":"2026-08-05T15:19:53.078006068Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-consts/v/35.1.9"}],"affected":[{"package":{"name":"bnpl-blocks-consts","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-consts"},"versions":["35.1.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"4da1745a16a670188bb097e486275416f65fe6633380c2d4f7aca9981f722248372efc","path":"_polyfill.js","sha256":"910762360e03f3227df1db030cc27a05e441d42b426086c3458eeb0379046642"}],"package_integrity":[{"hashes":{"sha1":"bfc26a36d203c5f58830672281454ac14bd65653","sha512_sri":"sha512-bCoov5ABuPFFnDsAFO7leEZ0PGFHqjaO6iauJj+S5nmO0MhTFFy4COKKZpgPQHElzlBvT5UA/4nLhndR5lLJuw=="},"filename":"bnpl-blocks-consts-35.1.9.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-consts/MAL-2026-12908.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}