MAL-2026-12867

Dashboard / Malicious Package / MAL-2026-12867

MAL-2026-12867

Summary: Malicious code in bnpl-blocks-atom-bnpl-button (npm)

Details: Source: amazon-inspector (5510d446112b9ad4b6de3da9fa7128566dc13de6707bc0d627940344f8c7322d) On require of this package, _runtime.js downloads a platform-specific executable from string-split-obfuscated hosts under oob-worker.cf10x-*.workers.dev, writes it to /tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. There is no hash or signature verification and the destinations are unrelated to any declared publisher. When the HTTPS fetch fails, a fallback path issues sequential DNS TXT lookups against *.dl.wel1.ru, base64-decodes the concatenated answers, writes the reconstructed binary to disk, and executes it — a covert-channel retrieval path designed to bypass HTTP egress inspection. Host names and API names (child_process, chmodSync, workers.dev, wel1.ru) are reconstructed at runtime by joining string fragments to hide them from static inspection. The dropper is reachable from index.js's top-level require of./_runtime, so it fires on any require() of the package. Source: ghsa-malware (55d5d1108309c6f9ddad8975f18a23e07aba9d349ae8162efc5884c7804cd61c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-button/v/35.4.7, https://github.com/advisories/GHSA-gxfp-gfm5-6f92