MAL-2026-12879

Dashboard / Malicious Package / MAL-2026-12879

MAL-2026-12879

Summary: Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

Details: Source: amazon-inspector (d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60) On require(), the package's main entry loads _ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames (e.g. oob-worker.cf103-070.workers.dev and additional Cloudflare Workers subdomains) with a DNS TXT fallback via *.dl.wel1.ru, downloads a platform-specific binary via https.get, writes it to a temporary path under a disguised name (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via spawn("/bin/sh",["-c", fp+" &"], {detached:true}) on Unix or cmd.exe start /b on Windows. require("child_process") is itself reconstructed via string concatenation. No hash or signature verification is performed and the fetch destinations are anonymous, mutable, author-controlled hosts unrelated to any documented publisher. The package name and cover-story comments reference "session tracking" and "telemetry" but the traced behavior is a staged binary dropper. Source: ghsa-malware (99ad0a894bc68b41123e63730f8bc841b200600b3f7e456a01c62d0dda7569a2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-integrations-breadcrumbs/v/35.2.9, https://github.com/advisories/GHSA-q24r-8r2w-2x7q