{"id":"MAL-2026-13010","summary":"Malicious code in bnpl-blocks-mobile-bnpl-title (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5cf4f269562c9f3d9dd234e8c38b6d3408b636a4e743a6106dff730efce473ce)\nOn require of the package, index.js loads _support.js, which selects a per-platform binary path, downloads bytes from a pool of obfuscated Cloudflare Workers mirrors whose hostnames are reassembled at runtime from split string fragments (e.g. oob-worker.cf103-070.workers.dev), writes the payload to a disguised temp filename such as dotnet_diag_\u003chex\u003e.exe or.cache_\u003chex\u003e, chmods 0755 on POSIX, and spawns it detached via cmd.exe /c start /b or /bin/sh -c '\u003cpath\u003e &'. If HTTPS mirrors fail, a fallback covert channel resolves DNS TXT records under *.dl.wel1.ru, reassembles a base64-encoded executable from chunked TXT responses, and executes it the same way. No hash or signature check is performed. Hostnames are hidden via split-and-join to evade static inspection. The combination of import-time execution, unpinned remote payload, non-publisher hosts with obfuscated names, DNS-over-TXT payload transport, and detached background spawn is a full-host remote code execution channel against the installer.\n","modified":"2026-08-05T15:51:40.706126537Z","published":"2026-08-05T14:36:57Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015371","import_time":"2026-08-05T15:19:47.625924579Z","modified_time":"2026-08-05T14:36:57Z","sha256":"5cf4f269562c9f3d9dd234e8c38b6d3408b636a4e743a6106dff730efce473ce","source":"amazon-inspector","versions":["35.7.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-title/v/35.7.1"}],"affected":[{"package":{"name":"bnpl-blocks-mobile-bnpl-title","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-mobile-bnpl-title"},"versions":["35.7.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"bnpl-blocks-mobile-bnpl-title-35.7.1.tgz","hashes":{"sha1":"4be48e755540272cac0c1157bfb4a71169abdff2","sha512_sri":"sha512-V5XcY8PqAk0gV9Qh12GJMXXAbRZ0vf0ql1caZMLy2IuG4UUfNPu50aoYU1D+2iVJDhMKYg8rqWcPymkY2EGRhQ=="}}],"evidence_files":[{"path":"_support.js","sha256":"21a0e5033a0dfd87e8c749107fbd792592c48016f8f18a2605685f8273e7cc0c","tlsh":"36a1a59a15aa30184bb097e4cb174416fa5bf6a33380c2d4f76ca5841fb252483b2ffc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-title/MAL-2026-13010.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}