MAL-2026-12896

Dashboard / Malicious Package / MAL-2026-12896

MAL-2026-12896

Summary: Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

Details: Source: amazon-inspector (953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504) The package's `main` (`index.js`) requires `./_loader` at module load, causing `_loader.js` to download a platform-specific native executable from hardcoded Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) whose hostnames are reassembled at runtime via `Array.join` string splitting to evade static scanners. If HTTPS fetches fail, a secondary channel retrieves base64-encoded chunks from DNS TXT records under `*.dl.wel1.ru` and reassembles them into the binary payload. The downloaded bytes are written to /tmp or %TEMP% under disguised filenames (`.cache_<hex>`, `dotnet_diag_<hex>.exe`), chmod'd to 0755 on Unix, and spawned detached via `cp.spawn("/bin/sh", ["-c", fp + " &"])` or `spawn("cmd",...)` on Windows. No hash or signature verification is performed. Any `require()` or `import` of this package triggers full-host remote code execution. A second file, `lib/telemetry.js`, is not on the auto-executed graph in this version but contains structurally identical dropper primitives (base64 buffer to `/bin/sh -c filePath &`, chmod 0755, cp.spawn), mirroring the active loader.

References: https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-store-button/v/35.2.8