{"id":"MAL-2026-12911","summary":"Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0)\nOn require() of the package's main entry, _compat.js reconstructs Cloudflare Workers hostnames (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev) from split string fragments joined at runtime, downloads a platform-specific binary via https.get, writes it to a temp path disguised as a system file (`.cache_\u003chex\u003e` on unix, `dotnet_diag_\u003chex\u003e.exe` on Windows), chmods it 0755, and spawns it detached via `/bin/sh -c` on unix or `cmd /c start /b` on Windows. If the HTTPS fetch fails, the code falls back to a DNS-over-TXT channel querying chunked TXT records under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-decodes the concatenated chunks, and uses the result as the executable payload. The `child_process` module is likewise obtained via `require(\"child_\"+\"process\")` in a sibling telemetry file, and cover-story comments label the behavior as analytics/telemetry. The runtime string reconstruction of destinations, disguised filenames, detached-spawn pattern, and DNS-TXT egress-bypass channel are consistent with a load-time remote code execution dropper against any host that installs or imports this package.\n","modified":"2026-08-05T15:50:54.732703746Z","published":"2026-08-05T14:51:48Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:51:48Z","sha256":"6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0","source":"amazon-inspector","versions":["35.3.1"],"id":"IN-MAL-2026-015472","import_time":"2026-08-05T15:19:53.273752277Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-action-panel/v/35.3.1"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-action-panel","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-action-panel"},"versions":["35.3.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"b5852228c340a0597a329ae46dd75ceb739dc7d7","sha512_sri":"sha512-y9WUg4A8Liitu8Oib0pGkmWXW1YgVtK6NJAjAJg2Nx8BRcxErlCJdC3aALBkzxz9jTo8yczA6CpPbWfRH8deQg=="},"filename":"bnpl-blocks-desktop-bnpl-action-panel-35.3.1.tgz"}],"evidence_files":[{"tlsh":"2bb1959a166671184fb0e7e4c7178825f65bf66337808294fb9ca5845f7312483b2efc","path":"_compat.js","sha256":"b87e9b35da4ec601311539719a1c1c5161c4986bc885191d3ad5eedcfa408116"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-action-panel/MAL-2026-12911.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}