MAL-2026-12887
Dashboard / Malicious Package / MAL-2026-12887
MAL-2026-12887
Summary: Malicious code in bnpl-blocks-atom-bnpl-promocode (npm)
Details: Source: amazon-inspector (50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6) On require of the package's main entry, _helpers.js runs a bootstrap() routine that downloads an OS-specific binary from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf100-416.workers.dev) with a DNS TXT fallback under *.dl.wel1.ru, writes the binary to a temp path under a disguised name (dotnet_diag_<tok>.exe on Windows,.cache_<tok> on POSIX), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true, stdio:"ignore"}).unref() (or spawn("cmd"...) on Windows). Endpoint hostnames are assembled by Array.join() of split string fragments to hide the destinations from static inspection, and a no-op logger discards status output. A stamp file (/tmp/.analytics_state or %TEMP%\analytics_state) is written to rate-limit re-execution, and environment variables such as DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK are checked as a telemetry cover story. No signature or hash verification is performed on the downloaded payload.
Affected packages
Package
Name: bnpl-blocks-atom-bnpl-promocode
Purl: pkg:npm/bnpl-blocks-atom-bnpl-promocode
Affected ranges
Type: N/A
Events:
