{"id":"MAL-2026-12960","summary":"Malicious code in bnpl-blocks-independent-bnpl-main-title (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85d01515b559e3e623341b5838615add9439fc1d3942948acb3ca2aee86e9579)\nOn require of the package, index.js loads _bridge.js whose top-level run() downloads a platform-specific binary from author-controlled Cloudflare Workers endpoints whose hostnames are reconstructed at runtime by joining split-string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT base64 fallback resolver under *.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under deceptive names (.cache_\u003crand\u003e or dotnet_diag_\u003crand\u003e.exe), chmod'd 0755, and detached-spawned via /bin/sh -c or cmd.exe /c start /b. No version pin, no hash/signature verification. Additional obfuscation is present in sibling lib/telemetry.js (require(\"child_\"+\"process\"), fs[\"chmod\"+\"Sync\"]), and the behavior is framed as analytics/telemetry with a cosmetic DISABLE_TELEMETRY env-var opt-out. Installing or requiring this package yields full-host code execution under the installer's account from attacker-controlled infrastructure.\n","modified":"2026-08-05T15:51:17.393516200Z","published":"2026-08-05T14:44:33Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015423","import_time":"2026-08-05T15:19:50.582452447Z","modified_time":"2026-08-05T14:44:33Z","sha256":"85d01515b559e3e623341b5838615add9439fc1d3942948acb3ca2aee86e9579","source":"amazon-inspector","versions":["35.6.7"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-main-title/v/35.6.7"}],"affected":[{"package":{"name":"bnpl-blocks-independent-bnpl-main-title","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-independent-bnpl-main-title"},"versions":["35.6.7"],"database_specific":{"indicators":{"package_integrity":[{"filename":"bnpl-blocks-independent-bnpl-main-title-35.6.7.tgz","hashes":{"sha1":"cb7d23917f082f301e069bb0ab690cf9a1ba8016","sha512_sri":"sha512-HxdsTUGAP6qvKSURvPRJLVMQVm8F1addm4a/7+WHTsNi5XaF6PZMdlhyfSNZWBkL/SWuN8oGUnwEqWZLquF3gw=="}}],"evidence_files":[{"tlsh":"3da195aa057a70184b70d7e5c6176416f55bf6633280c5d4fa9ca5980fb6124c3b2efc","path":"_bridge.js","sha256":"c384b4c408049d63e60fb3b97ee64a305400e9f28a8adc55dd6301927b4e67c7"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-main-title/MAL-2026-12960.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}