{"id":"MAL-2026-12979","summary":"Malicious code in bnpl-blocks-mobile-bnpl-article-author (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd)\nOn require of the package, index.js loads _shim.js which reconstructs a set of Cloudflare Workers hostnames (oob-worker.cf101-adf/102-baf/99-9b3/103-070.workers.dev) and DNS-TXT fallback domains (sdk/ext/pkg/net.dl.wel1.ru) from array fragments joined at runtime, downloads an opaque binary over HTTPS (with a DNS-TXT chunked base64 covert channel as fallback when HTTPS egress is blocked), writes it to /tmp or the Windows temp directory under disguised names such as.cache_\u003crnd\u003e or dotnet_diag_\u003crnd\u003e.exe, chmods it to 0755, and spawns it detached via /bin/sh -c '\u003cpath\u003e &' or cmd /c start. Destination hostnames are obfuscated via string-split-and-join to evade static detection. Installing or importing this package results in execution of attacker-controlled native code on the host with the installer's privileges.\n","modified":"2026-08-05T15:51:25.984981021Z","published":"2026-08-05T14:40:08Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:40:08Z","sha256":"1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd","source":"amazon-inspector","versions":["35.3.3"],"id":"IN-MAL-2026-015393","import_time":"2026-08-05T15:19:48.945775438Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-article-author/v/35.3.3"}],"affected":[{"package":{"name":"bnpl-blocks-mobile-bnpl-article-author","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-mobile-bnpl-article-author"},"versions":["35.3.3"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"ae8124d0c7e15b913407412399669d912851d9c41d747e5a582b6cdcd4d7695a","tlsh":"2ea1a8aa156a701987b0d7f48717541af66bf6633380c6d4f75c59880f7312483b2eec","path":"_shim.js"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-article-author-35.3.3.tgz","hashes":{"sha1":"9af38fd23c38b0fc12cd37114625069324577924","sha512_sri":"sha512-5RsqgDcqKo6PQHKMQvHtbqMYKg7Koa58S7QqOtVNtJua4z/G/K6WunzI0/U3H6P7H8UHEMwexsbqRAORoAoC0Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-article-author/MAL-2026-12979.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}