{"id":"MAL-2026-13009","summary":"Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d)\nOn require of index.js, _support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru, writes the response to a temp path using masquerading filenames (.cache_*, dotnet_diag_*.exe), chmods it to 0755, and spawns it detached via cp.spawn(\"/bin/sh\", [\"-c\", fp + \" &\"], {detached:true}). Destination hostnames are assembled at runtime by array-join (e.g., [\"oob-worker.cf102-baf\",\".wo\",\"rke\",\"rs.de\",\"v\"].join(\"\")) and require(\"child_\"+\"process\") is used to evade static scanners. A second bundled module lib/telemetry.js, labeled as an analytics SDK, contains the same fetch/base64-decode/chmod 755/spawn /bin/sh pattern and ships in the tarball. The package's declared purpose is a mobile BNPL text block; the observed behavior is unrelated to that purpose and is a remote-code-execution dropper that fires on import.\n","modified":"2026-08-05T15:51:40.650702842Z","published":"2026-08-05T14:36:10Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T14:36:10Z","sha256":"cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d","source":"amazon-inspector","versions":["35.2.2"],"id":"IN-MAL-2026-015366","import_time":"2026-08-05T15:19:47.309165711Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-text-block/v/35.2.2"}],"affected":[{"package":{"name":"bnpl-blocks-mobile-bnpl-text-block","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-mobile-bnpl-text-block"},"versions":["35.2.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-text-block/MAL-2026-13009.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-text-block-35.2.2.tgz","hashes":{"sha1":"8cbbde1ed22fbec45b2ac006116006d3f240e039","sha512_sri":"sha512-1H+o+84h/EXRn8rrPf7DQNwZESrC1PZ/qy7B4Yo6NiEwFcXyZypU7PpjFJ1C2klGtvCcQiqkkVL+q18V6r02UA=="}}],"evidence_files":[{"sha256":"67b70f6d5cd9e3dce38b927233b04fd715050e3b3f01c32885ec11145867ccde","tlsh":"57a185aa0566701847b0ebe4c61b5415f55bf663778086c8f7ac65d80ff212483b2efc","path":"_support.js"},{"path":"lib/telemetry.js","sha256":"5287bb1db9349d4b28c482269fe4a0c00089db69be0ea11743b7147a3b6ada4b","tlsh":"5b835055566a202186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffd"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}