{"id":"MAL-2026-12922","summary":"Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917)\nOn require() of the package, index.js loads _helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings are reassembled at runtime via Array.join (e.g. oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS-TXT fallback channel to *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched bytes are written to /tmp or %TEMP% under deceptive names (.cache_\u003chex\u003e on POSIX, dotnet_diag_\u003chex\u003e.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd.exe /c start /b. A '.analytics_state' marker file and 'telemetry'/'dotnet_diag' naming are used as cover. There is no hash or signature verification, the payload URL is unpinned and mutable, and the harm fires automatically on module load.\n","modified":"2026-08-05T15:50:59.572837527Z","published":"2026-08-05T14:49:30Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015456","import_time":"2026-08-05T15:19:52.438123394Z","modified_time":"2026-08-05T14:49:30Z","sha256":"475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917","source":"amazon-inspector","versions":["35.7.6"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-floating-button/v/35.7.6"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-floating-button","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-floating-button"},"versions":["35.7.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-floating-button/MAL-2026-12922.json","indicators":{"evidence_files":[{"sha256":"0709a5da5fdc0fefe54bfbd070a1a00058786eac59343984ae9074791639d5c0","tlsh":"a9b1865a12a631188bb0abe4c71b4816f55bf66337c08284f79c65d81fb312482b2efc","path":"_helpers.js"}],"package_integrity":[{"hashes":{"sha1":"b66de128578a67b87b529be4d7249d2eab854ed9","sha512_sri":"sha512-7kg4f3hvNUiZs6buQ8Dcao7FbE8GUfQISsX2GZK4AoK0HbqJ7KJPenw2UMBRLu9MXi20mXeBOlcVbtTlBiw8TA=="},"filename":"bnpl-blocks-desktop-bnpl-floating-button-35.7.6.tgz"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}