{"id":"MAL-2026-12940","summary":"Malicious code in bnpl-blocks-desktop-bnpl-shopping-banner (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9dbec840b48cc522f6dcdda0ea3569cd85730d1fee219bd0b6ce46007917f61e)\nOn require, index.js loads _support.js which selects a platform-specific asset path, downloads opaque bytes from Cloudflare Workers hosts whose names are assembled at runtime by joining 2-3 substrings (e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes them to a temp file under a decoy name (dotnet_diag_\u003chex\u003e.exe on Windows,.cache_\u003chex\u003e on Unix), chmods 0755, and spawns the file detached via cmd.exe /c start on Windows or /bin/sh -c... & on Unix. A fallback delivery path queries DNS TXT records under c.net.dl.wel1.ru for a chunk count and then iterates i\u003cn\u003e.net.dl.wel1.ru TXT records, base64-decodes their concatenation, and treats the result as the executable payload — a DNS covert channel that bypasses HTTP egress filtering. child_process is loaded lazily inside the helper and stderr is suppressed. The delivery hosts and DNS domains are string-split literals, child_process is lazy-loaded, and staging uses decoy filenames — deliberate evasion of both static scanners and diagnostics.\n","modified":"2026-08-05T15:51:07.895071212Z","published":"2026-08-05T14:48:00Z","database_specific":{"malicious-packages-origins":[{"sha256":"9dbec840b48cc522f6dcdda0ea3569cd85730d1fee219bd0b6ce46007917f61e","source":"amazon-inspector","versions":["35.4.6"],"id":"IN-MAL-2026-015446","import_time":"2026-08-05T15:19:51.87370313Z","modified_time":"2026-08-05T14:48:00Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-shopping-banner/v/35.4.6"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-shopping-banner","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-shopping-banner"},"versions":["35.4.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-shopping-banner/MAL-2026-12940.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"7c9368c6a0315d27f4211e7494336cafeb583b56b97f2adc69b2475c0e9ef422","tlsh":"6da1766a166670188b70dbe0c6175415f56af2637380c1d4f79ca9985fb322483b3efc","path":"_support.js"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-shopping-banner-35.4.6.tgz","hashes":{"sha1":"eec5353fdf07a69d1fbd8a50b5a51e9ef09bfeb2","sha512_sri":"sha512-Qoz0oDb6JX8NTepU9v8z1MRF8zM95y1cC78oFwJpQXfq4n/ze0IV5v8PCNZ8QGoz1K3ozbNPmCjc/7ewkTZlYA=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}