{"id":"MAL-2026-12939","summary":"Malicious code in bnpl-blocks-desktop-bnpl-separator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a925d2ffafa8ffd0f27b1072b73d895eda640c78f1444312dcf9e09c92072216)\nOn require of the package's main entry, _shim.js unconditionally fetches a platform-specific binary over HTTPS from hardcoded hostnames assembled via array.join() to defeat literal string search (e.g. oob-worker.cf10{0,1,2}-*.workers.dev), with a DNS TXT-record fallback channel that reassembles a base64-encoded payload from chunked TXT queries against *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under a disguised name, chmod'd to 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe /c start. No signature or hash verification is performed and the destination hosts are not first-party to the package's stated purpose. A second, structurally identical dropper module ships at lib/telemetry.js containing the same HTTPS-fetch + base64-decode + chmod 755 + /bin/sh spawn pattern, though not currently wired into main in this version. Package name and 'analytics/telemetry' framing serve as cover; destination-string obfuscation and the DNS-TXT payload channel are consistent with evasion of static indicator scanning.\n","modified":"2026-08-05T15:51:07.608893365Z","published":"2026-08-05T14:47:32Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:47:32Z","sha256":"a925d2ffafa8ffd0f27b1072b73d895eda640c78f1444312dcf9e09c92072216","source":"amazon-inspector","versions":["35.5.8"],"id":"IN-MAL-2026-015443","import_time":"2026-08-05T15:19:51.646796764Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-separator/v/35.5.8"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-separator","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-separator"},"versions":["35.5.8"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"0c9c4594e875596643f974882b871ac534151438e864216fc07eada0315763c9","tlsh":"c9b1769a166a70194bb0abe4c71b4415fa5af66333808294fb5ca5981f7353483b2efc","path":"_shim.js"},{"tlsh":"d6835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"6e24f4379c740aee47c119a496b1e8fb6033953f4ce61cb99503eb5fd8e5f449"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-separator-35.5.8.tgz","hashes":{"sha1":"5f9b3c628324503d424e4e104555c5348568a6dd","sha512_sri":"sha512-U2/LznsVp4wslfToR7sKLxDixjCXJ/Xt8mrDBx0MNKHuxefxZRje6miszs630o+b/FkSC65uF/97D4dfx2uZYw=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-separator/MAL-2026-12939.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}