{"id":"MAL-2026-13011","summary":"Malicious code in bnpl-blocks-mobile-large-bnpl-reviews (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f4fb3bbd6df612646af310ca9ec9e4d53cdeed9298b7e3e7c0460439b92d2955)\nOn require() of this package, _loader.js selects a platform-specific asset path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), downloads it over HTTPS from attacker-controlled hosts whose hostnames are reconstructed via split-and-join string obfuscation (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a covert DNS TXT base64 fallback channel to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched binary is written to /tmp or %TEMP% under disguised names such as dotnet_diag_\u003ctok\u003e.exe or.cache_\u003ctok\u003e, chmodded to 0755, and spawned detached via /bin/sh -c or cmd /c start with stdio ignored. There is no signature or hash verification, and the require() of child_process is itself obfuscated (require(\"child_\" + \"process\")). Cover-story opt-out env vars and analytics/dotnet_diag filenames provide plausible-deniability framing.\n","modified":"2026-08-05T15:51:41.016527731Z","published":"2026-08-05T14:36:23Z","database_specific":{"malicious-packages-origins":[{"sha256":"f4fb3bbd6df612646af310ca9ec9e4d53cdeed9298b7e3e7c0460439b92d2955","source":"amazon-inspector","versions":["35.8.2"],"id":"IN-MAL-2026-015367","import_time":"2026-08-05T15:19:47.339676291Z","modified_time":"2026-08-05T14:36:23Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-mobile-large-bnpl-reviews/v/35.8.2"}],"affected":[{"package":{"name":"bnpl-blocks-mobile-large-bnpl-reviews","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-mobile-large-bnpl-reviews"},"versions":["35.8.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_loader.js","sha256":"3f151bd71c4f4d8030846bf3299598ea465e3eab15e6bf215c39919469229672","tlsh":"fda1975a12aa30158bb09be5c7174416f65ae6a33780c2c4fb5ca9944f77128c3b2efc"}],"package_integrity":[{"filename":"bnpl-blocks-mobile-large-bnpl-reviews-35.8.2.tgz","hashes":{"sha1":"0fc3a36012b8eafb4c490660da7cab4eae57cbfc","sha512_sri":"sha512-qAiBatPN/TAaZOOU37QPaX/psIGKKBDACq+yq8Nus4yMs8RCy1K0TDHxKPYDr+wlvLQrTNwWWA1Wuh0PMlvVKg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-large-bnpl-reviews/MAL-2026-13011.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}