{"id":"MAL-2026-12978","summary":"Malicious code in bnpl-blocks-mobile-bnpl-anchor-title (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (333f50949b082f2782be370d736513e8f5165fd3b6abea7d887a7bc73eacea9c)\nOn require() of the package's main entry, index.js loads _platform.js which fetches a platform-specific binary from Cloudflare Workers hostnames (oob-worker.cf*.workers.dev) reconstructed via.join('') from split string fragments, with a DNS-TXT record fallback channel (c.\u003cdomain\u003e count + numbered TXT records reassembled from base64) pointing at *.dl.wel1.ru to bypass HTTP egress filtering. The fetched bytes are written to /var/tmp or %TEMP% under cover-story names (dotnet_diag_\u003crand\u003e.exe on Windows,.cache_\u003crand\u003e on Unix), chmod 0755 on Unix, and spawned detached via spawn('/bin/sh',...) or spawn('cmd', ['/c', 'start',...]). A TTL marker file suppresses re-runs. Hosts are not publisher-controlled, unrelated to any documented package purpose, and no hash/signature verification is performed. A second dropper variant with the same shape is present in lib/telemetry.js wrapped as a fake analytics SDK; it is not reachable from index.js in this version.\n","modified":"2026-08-05T15:51:25.306435975Z","published":"2026-08-05T14:40:48Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:40:48Z","sha256":"333f50949b082f2782be370d736513e8f5165fd3b6abea7d887a7bc73eacea9c","source":"amazon-inspector","versions":["35.8.3"],"id":"IN-MAL-2026-015397","import_time":"2026-08-05T15:19:49.187766279Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-anchor-title/v/35.8.3"}],"affected":[{"package":{"name":"bnpl-blocks-mobile-bnpl-anchor-title","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-mobile-bnpl-anchor-title"},"versions":["35.8.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"53471bada512c4ce077721c9531e38017c5eb9af6320c22afb8a0359c48758cd","tlsh":"f9a1749a166671188b709be4c71b4416f65bf6633380c684f79c68985fb352483b2efc","path":"_platform.js"},{"tlsh":"c0835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc","path":"lib/telemetry.js","sha256":"b049cca64ae26ceee79c9769956d313b67834ee08329d4e00105dcc8582881f2"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-anchor-title-35.8.3.tgz","hashes":{"sha512_sri":"sha512-rB+AhUdercCF7PuHmeiSCAJUUCZLAQjxScLSp1/5fI2YyQA4WT5gSdOW2l1N+Bnt0qUeXuxIA0Hu+P8MBb7nEg==","sha1":"91c284991e5390157371db050cf093a09ace7646"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-anchor-title/MAL-2026-12978.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}