MAL-2026-12884

    Dashboard / Malicious Package / MAL-2026-12884

    MAL-2026-12884

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bnpl-blocks-atom-bnpl-notification (npm)

    Details: Source: amazon-inspector (80f343dda3cb4e6b3420db34a6a801aeeeaf60ecf1ea23ad78de4c7605b954d2) index.js unconditionally requires./_runtime on load. _runtime.js reconstructs Cloudflare Workers hostnames (oob-worker.cf10{1,2,3}-*.workers.dev) via string-split/array-join obfuscation, with a DNS-TXT chunked-base64 fallback channel keyed on platform, downloads platform-specific opaque bytes over HTTPS, writes them to /var/tmp or %TEMP% under cover names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmods 0755 on POSIX, and spawns the payload detached via /bin/sh -c 'path &' or cmd.exe /c start. lib/telemetry.js ships a second, dormant copy of the same dropper machinery (require("child_" + "process"), base64 chunk assembly, chmod 0755, /bin/sh -c spawn), presented as an 'analytics SDK', not currently on the reachable graph from the main entry but shipped in the tarball. The package name presents as a BNPL UI notification block; the actual behavior on require is fetch-and-execute of attacker-controlled bytes, which is unrelated to any legitimate purpose.

    Affected packages

    Package

    Name: bnpl-blocks-atom-bnpl-notification

    Purl: pkg:npm/bnpl-blocks-atom-bnpl-notification

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.3.8
    MAL-2026-12884 | CVE-DB