{"id":"MAL-2026-12942","summary":"Malicious code in bnpl-blocks-desktop-bnpl-tab-buttons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (10f3c6bfbfc78abe18386c92d3ab2a2fde60f132517944f3d3f015bf3ba660bf)\nOn require of this package, index.js loads _platform.js, which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT-record fallback channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under disguised names (dotnet_diag_*.exe,.cache_*, loader_mac, package.exe, package, package-arm64), chmodded 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Endpoint hostnames and dangerous APIs are assembled at runtime from split string fragments (e.g. [\"oob-worker.cf99-9b3.worke\",\"rs.de\",\"v\"].join(\"\"), require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]) to evade string scanners. A per-host dedup stamp (.analytics_state) is written to avoid re-triggering. A second, redundant dropper implementation is bundled in lib/telemetry.js, which assembles a base64 payload from DNS TXT records, writes it to disk, chmods it 0755, and detached-spawns /bin/sh. No pinning, hashing, or signature verification is performed on the fetched executables. The package name and 'Analytics SDK' framing in comments do not match the observed behavior.\n","modified":"2026-08-05T15:51:09.037590054Z","published":"2026-08-05T14:46:08Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015434","import_time":"2026-08-05T15:19:51.189234649Z","modified_time":"2026-08-05T14:46:08Z","sha256":"10f3c6bfbfc78abe18386c92d3ab2a2fde60f132517944f3d3f015bf3ba660bf","source":"amazon-inspector","versions":["35.9.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-tab-buttons/v/35.9.2"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-tab-buttons","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-tab-buttons"},"versions":["35.9.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"3da1a79a02a670184bb0dbe4ca275419f61bf6633780c6c4fb5ca5d41fb212483b2efc","path":"_platform.js","sha256":"b2cb7b68260aa601910a54de32f5f6a71b15086355937c6b1c5dc38a340d527f"},{"tlsh":"c3835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"42e2495c04cbc20b56e3fbb9480015bf7b10b9b2f70170160ebdfdab32053202"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-tab-buttons-35.9.2.tgz","hashes":{"sha1":"6d543c6eb4b90df327a2ee03b1a2f73b79a5d6c6","sha512_sri":"sha512-jddvzeNVDnhwOpIknksZe1AKJCDsQEkGJaxEZW1/LPnvIXaLWOJgq2Q/M4+9IYA5toz/8nRIuzZAHarkFMHtqA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-tab-buttons/MAL-2026-12942.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}