{"id":"MAL-2026-12992","summary":"Malicious code in bnpl-blocks-mobile-bnpl-header-search (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370)\nOn require of the package's main entry, `_shim.js` constructs Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf103-070, cf101-adf, cf99-9b3 subdomains) by joining string fragments, downloads an opaque binary over HTTPS, and falls back to a base64-over-DNS-TXT channel under *.dl.wel1.ru (reading `c.\u003cdomain\u003e` TXT for a chunk count then `\u003ci\u003e.\u003cdomain\u003e` TXT records) when HTTPS is unavailable. The payload is written to /var/tmp or %TEMP% under a disguised filename such as `dotnet_diag_\u003crnd\u003e.exe` or `.cache_\u003crnd\u003e`, chmod 0755 on Unix, and spawned detached via `/bin/sh -c '\u003cpath\u003e &'` or `cmd.exe /c start /b`. A marker file (`/tmp/.analytics_state` / `%TEMP%\\analytics_state`) rate-limits re-execution to roughly once per 20787 seconds, and the loader silently no-ops when `DISABLE_TELEMETRY`, `ANALYTICS_OPT_OUT`, or `DO_NOT_TRACK` are set — telemetry-flavored naming that does not match the fetch-and-execute-native-code behavior. Package name (`bnpl-blocks-mobile-bnpl-header-search`) does not correspond to any functionality that would justify downloading and running a native binary.\n","modified":"2026-08-05T15:51:31.523063281Z","published":"2026-08-05T14:38:31Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:38:31Z","sha256":"0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370","source":"amazon-inspector","versions":["35.3.7"],"id":"IN-MAL-2026-015382","import_time":"2026-08-05T15:19:48.359115605Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-header-search/v/35.3.7"}],"affected":[{"package":{"name":"bnpl-blocks-mobile-bnpl-header-search","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-mobile-bnpl-header-search"},"versions":["35.3.7"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"5cb1869a06a970194bb0e7e4ca1b4415f59bf6633781c1d4fb5ca9885fb31248372efc","path":"_shim.js","sha256":"a3cbc35edfe11e7e8790fe8d0f09a13b47c5d3c6cbb75cac143e917ea7abdae0"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-header-search-35.3.7.tgz","hashes":{"sha1":"356919c05eae740066458ae5860b5aa9141369d5","sha512_sri":"sha512-Cfa6Cu5R0fNu+4n1E8nsmlGxtWuvTZo+yTQp7qHTEvLRWKTY+zPkBAhv6Q31PY4Z+Nw6g3rIpPP2xAhw+QZHGA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-header-search/MAL-2026-12992.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}