{"id":"MAL-2026-12943","summary":"Malicious code in bnpl-blocks-desktop-bnpl-table (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53a00a782a1b951d114dd07c4e2e5bf08226730274beb0b88842034b5c71e9dd)\nOn require of the package, index.js unconditionally loads _adapter.js, which selects a payload URL based on OS/arch and downloads a binary from one of three Cloudflare workers.dev hosts whose names are assembled at runtime by joining string fragments (e.g., [\"oob-work\",\"er.cf99-9b3\",\".w\",\"or\",\"kers\",\".dev\"].join(\"\")), with a DNS-TXT covert-channel fallback resolving through *.dl.wel1.ru. The downloaded bytes are written to a temp path under a deceptive name (dotnet_diag_\u003crand\u003e.exe on Windows,.cache_\u003crand\u003e on Unix), chmod 0755, and spawned detached via /bin/sh -c \"\u003cpath\u003e &\" or cmd.exe /c start /b. No integrity check, no publisher-controlled destination, and the destination hostnames are obfuscated to defeat static analysis. Kill-switch environment variables (DISABLE_TELEMETRY, DO_NOT_TRACK) and a stamp file gate re-execution. The package's declared purpose (a BNPL block/table component) does not require fetching or executing any binary, and the delivery infrastructure is anonymous relay hosts rather than a publisher-owned domain.\n","modified":"2026-08-05T15:51:09.326470478Z","published":"2026-08-05T14:48:17Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015448","import_time":"2026-08-05T15:19:52.04576073Z","modified_time":"2026-08-05T14:48:17Z","sha256":"53a00a782a1b951d114dd07c4e2e5bf08226730274beb0b88842034b5c71e9dd","source":"amazon-inspector","versions":["35.4.7"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-table/v/35.4.7"}],"affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-table","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-table"},"versions":["35.4.7"],"database_specific":{"indicators":{"evidence_files":[{"path":"_adapter.js","sha256":"c1aa1c45576b9a24eedf91a9db39a62b5e5b6107f4122304db01f2f21064e54f","tlsh":"f8a1875a05a6b0184bb0dbe0c61b8816f65bf6633781c188f79c69989f735248372dfc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-table-35.4.7.tgz","hashes":{"sha512_sri":"sha512-VgWqAqOcPjMCrjXv5aJF7MN+O3fRtbnVgTI8BnyNVaTkt0rGJKIXABckeYJYs1zRK7zFdVjrtvNkzP8sxeOrIA==","sha1":"63c0f8611d8c6d89e982dd814ac53136b5d09668"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-table/MAL-2026-12943.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}