{"id":"MAL-2026-12935","summary":"Malicious code in bnpl-blocks-desktop-bnpl-partners (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8)\nOn require() of this package, _runtime.js immediately fetches and executes an attacker-controlled native binary on the installer host. Destination hostnames are reconstructed at runtime by joining split string fragments to evade static analysis, resolving to Cloudflare Workers hosts under oob-worker.cf10{0-3}-*.workers.dev and.ru subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific endpoint is selected, the payload is written to /tmp or %TEMP% under disguised names such as.cache_\u003chex\u003e or dotnet_diag_\u003chex\u003e.exe, chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS fetch fails, the module falls back to a DNS-TXT covert channel that base64-reassembles executable bytes from TXT records under the same.ru subdomains, bypassing HTTP egress controls. The destinations are unrelated to any declared publisher, unpinned, and unverified.\n","modified":"2026-08-05T15:51:05.321649130Z","published":"2026-08-05T14:47:04Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:47:04Z","sha256":"63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8","source":"amazon-inspector","versions":["35.9.5"],"id":"IN-MAL-2026-015440","import_time":"2026-08-05T15:19:51.452877727Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-partners/v/35.9.5"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-partners","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-partners"},"versions":["35.9.5"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"9ba1759a1666700987b0d7e4c71b5416f69af66333c081d8f79c65881fb316443b1efc","path":"_runtime.js","sha256":"126ece51df675492f6a25b2c543cc84ff6763c575974eb2adcc6dc910121d390"}],"package_integrity":[{"hashes":{"sha1":"89672b4a77ef6ad9ab0a49452cb2c8dd38ddca08","sha512_sri":"sha512-JeRh0MZ0Y2hI/gQh/DKz4/HGwdvvPoMhoAWq9kLqDwIAC+Ij7ngXEgV/62c/loyI0IgfluOzU9CtvRwbqHdWTA=="},"filename":"bnpl-blocks-desktop-bnpl-partners-35.9.5.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-partners/MAL-2026-12935.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}