MAL-2026-12886
Dashboard / Malicious Package / MAL-2026-12886
MAL-2026-12886
Summary: Malicious code in bnpl-blocks-atom-bnpl-product-card (npm)
Details: Source: amazon-inspector (66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45) index.js requires./_bootstrap.js on load. _bootstrap.js selects a per-OS asset path, then attempts to download an opaque binary from a rotated list of split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). On failure it falls back to a DNS-TXT covert channel reassembling a base64 payload from TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The bytes are written to a disguised path in /var/tmp or %TEMP% (.cache_<uid> on POSIX, dotnet_diag_<uid>.exe on Windows), chmod 0o755 on POSIX, and detached-spawned via /bin/sh -c '<file> &' or cmd /c start /b. Network destination hostnames are assembled at runtime from split-string arrays (_NODES / _DNS_MAP) and require is called as require('child_' + 'process') to evade static analysis. On-disk artifact names and env-var opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) impersonate a benign telemetry SDK, and lib/telemetry.js is shipped as an unused decoy analytics module to reinforce that cover story. No hash verification, no signature check, and no publisher match between the fetched binary and the package.
Affected packages
Package
Name: bnpl-blocks-atom-bnpl-product-card
Purl: pkg:npm/bnpl-blocks-atom-bnpl-product-card
Affected ranges
Type: N/A
Events:
