MAL-2026-12909
Dashboard / Malicious Package / MAL-2026-12909
MAL-2026-12909
Summary: Malicious code in bnpl-blocks-data-schema-generator (npm)
Details: Source: amazon-inspector (b1e39c2d94a6114333c4275444d786188f00056a96e6e6296cd3abf275e3d5bc) index.js unconditionally requires _bootstrap.js, which on module load reconstructs Cloudflare Workers subdomains (oob-worker.cf10x-xxx.workers.dev) and *.dl.wel1.ru hosts from split string fragments, fetches a platform-specific executable via https.get with a DNS-TXT fallback that reassembles base64 chunks from numbered subdomains, writes the payload to a temp path under disguised names (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start. A second file lib/telemetry.js labelled as a telemetry SDK contains the same write+chmod+spawn primitives (Buffer.from(chunks,'base64'), cp.spawn('/bin/sh',['-c', filePath+' &']), fs['chmod'+'Sync'](extensionPath, 0755)) as a redundant dropper. The behavior fires whenever any consumer require()s the package, giving arbitrary remote code execution on the installer's host.
Affected packages
Package
Name: bnpl-blocks-data-schema-generator
Purl: pkg:npm/bnpl-blocks-data-schema-generator
Affected ranges
Type: N/A
Events:
