{"id":"MAL-2026-12929","summary":"Malicious code in bnpl-blocks-desktop-bnpl-image-with-caption (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da)\nOn require of this package, index.js loads _ext.js which selects a platform-specific asset name and downloads a native binary from obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), assembled at runtime by joining split string fragments. If HTTPS delivery fails, the code falls back to a DNS TXT-record channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenating and base64-decoding chunked TXT responses into a binary payload. The payload is written to /tmp or %TEMP% under disguised names such as dotnet_diag_\u003ctag\u003e.exe and.cache_\u003ctag\u003e, chmodded 0755, and spawned detached via cp.spawn(\"/bin/sh\", [\"-c\", fp+\" &\"], {detached:true}) or spawn(\"cmd\",...). No hash or signature verification is performed. The 'child_process' module identifier is also reconstructed via string-splitting, and cover-story comments label the behavior as 'telemetry' and 'analytics' with a state file 'analytics_state'. The package's stated purpose (a reusable UI block) does not justify any binary fetch or execution.\n","modified":"2026-08-05T15:51:02.497851758Z","published":"2026-08-05T14:48:35Z","database_specific":{"malicious-packages-origins":[{"versions":["35.4.2"],"id":"IN-MAL-2026-015450","import_time":"2026-08-05T15:19:52.168805695Z","modified_time":"2026-08-05T14:48:35Z","sha256":"3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-image-with-caption/v/35.4.2"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-image-with-caption","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-image-with-caption"},"versions":["35.4.2"],"database_specific":{"indicators":{"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-image-with-caption-35.4.2.tgz","hashes":{"sha1":"e874164fe12c0aa0d995ad79e47fa9ec8b3e8968","sha512_sri":"sha512-z1UT1V/KaQXyEX8KfLT3AMY8NqgOERy3lupk5gusd6HYm2RGYSVLE94ThVC1rTKCiTniIJVVsFbFCg7SwfGdkQ=="}}],"evidence_files":[{"sha256":"a2e78e2944936bc058fc0c440551a43b4127c902400988af48c5b5a817107cbd","tlsh":"74b1955612a6701c4bb0ebe4cb0b9415f61bf66337818284fb9c65985f7321482b2efc","path":"_ext.js"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-image-with-caption/MAL-2026-12929.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}