MAL-2026-12917

Dashboard / Malicious Package / MAL-2026-12917

MAL-2026-12917

Summary: Malicious code in bnpl-blocks-desktop-bnpl-card-panel (npm)

Details: Source: amazon-inspector (c8a6a3ee94c8a00269c44eb09de0f4e5234a6df3a4081ec7fe0d0fa6ccd0b01e) On require, index.js loads _polyfill.js which selects a platform-specific payload path, downloads bytes over HTTPS from string-split-obfuscated Cloudflare workers.dev hostnames (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked base64 fallback over sdk.dl.wel1.ru, writes the bytes to a temp file under a decoy name (dotnet_diag_*.exe /.cache_*), chmods it 0755, and spawns it detached via cmd.exe or /bin/sh. There is no version pin, no hash check, and no signature verification. Destination hostnames are assembled by concatenating string fragments (e.g. ["oob-worker.cf101-adf.workers.","de","v"].join("")) and a DNS-TXT covert-channel fallback (resolveTxt("c."+domain) + base64 decode) is implemented to survive HTTPS egress blocking. The child_process spawn of a downloaded binary confirms code execution, not telemetry.

References: https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-card-panel/v/35.9.2