MAL-2026-12913

Dashboard / Malicious Package / MAL-2026-12913

MAL-2026-12913

Summary: Malicious code in bnpl-blocks-desktop-bnpl-article-author (npm)

Details: Source: amazon-inspector (f80a4ff82e37de309fbc903891bd8ac770f0542251e9b4afc15fbd36e94ac21c) On require, index.js loads _shim.js, which fetches a platform-specific native executable from hardcoded hosts reconstructed at runtime via array `.join('')` to evade string search: `oob-worker.cf102-baf.workers.dev`, `oob-worker.cf103-070.workers.dev`, `oob-worker.cf99-9b3.workers.dev`. The fetched bytes are written to /tmp or %TEMP% under cover-story names (`dotnet_diag_*.exe`, `.cache_*`), chmodded 0755, and spawned detached via `spawn('/bin/sh', ['-c', fp + ' &'], {detached:true})` or `spawn('cmd',...)`. A DNS-over-TXT covert channel provides fallback delivery: `dns.resolveTxt` is used against `c.<domain>` and `<i>.<domain>` under `sdk.dl.wel1.ru`, `ext.dl.wel1.ru`, `pkg.dl.wel1.ru`, `net.dl.wel1.ru`; TXT records are base64-decoded, concatenated into an executable buffer, written to disk and spawned. A state file `.analytics_state` is maintained. The package's declared name ("session management") does not justify fetching or executing native binaries, and none of the destinations are publisher-owned or version-pinned; the delivered bytes are opaque, un-hashed, and mutable at the operators' discretion.

References: https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-article-author/v/35.9.6