{"id":"MAL-2026-12985","summary":"Malicious code in bnpl-blocks-mobile-bnpl-container (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2)\nThe package's main entry requires./_compat on load, which selects a platform-specific payload (Windows.exe, Linux ELF, macOS Mach-O), downloads it over HTTPS from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback channel that reassembles a base64 payload from numbered subdomains under wel1.ru. The fetched bytes are written to a disguised temp filename (dotnet_diag_\u003chex\u003e.exe /.cache_\u003chex\u003e), chmod 0755, and spawned detached via /bin/sh or cmd. Destination hostnames are reconstructed at runtime from array-joined string fragments to evade static matching. No hash or signature verification is performed. The package presents itself as a trivial platform adapter; the fetch-and-execute behavior is inconsistent with that stated purpose and is hidden behind DISABLE_TELEMETRY env-var opt-outs.\n","modified":"2026-08-05T15:51:28.809396159Z","published":"2026-08-05T14:41:09Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T15:19:49.292259448Z","modified_time":"2026-08-05T14:41:09Z","sha256":"d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2","source":"amazon-inspector","versions":["35.1.8"],"id":"IN-MAL-2026-015399"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-container/v/35.1.8"}],"affected":[{"package":{"name":"bnpl-blocks-mobile-bnpl-container","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-mobile-bnpl-container"},"versions":["35.1.8"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-container-35.1.8.tgz","hashes":{"sha512_sri":"sha512-DKOTv2x1gaOSUlnQBrv+n8hhET7y/O7OANqjl7xQ2jSI8xzT23XTbkYAZLIslz4W4QsiHKYncxOizWVFQAD6lg==","sha1":"40327a79c2a7e762095546d5ee92043268c8c8a4"}}],"evidence_files":[{"path":"_compat.js","sha256":"e75f2c3f3959015f2f13b4f6036c59e8981cfaf55d5df324bb699d0ba12f3f97","tlsh":"7ea187aa16a670198b70dbe4c7174416f65be6a33380c2c4fb9c69945f7352483b2efc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-container/MAL-2026-12985.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}