MAL-2026-12925

Dashboard / Malicious Package / MAL-2026-12925

MAL-2026-12925

Summary: Malicious code in bnpl-blocks-desktop-bnpl-header (npm)

Details: Source: amazon-inspector (0c6b73a025a319c8c2af1d616239d0950f911030ae9760506d6090be908ca935) On require() of this package, index.js loads _bridge.js, which reconstructs C2 hostnames from split string fragments (e.g. ["oob-worker",".cf","10","3-070.worke","rs.d","ev"].join("")) to resolve oob-worker.cf*.workers.dev endpoints and a DNS-TXT fallback under *.dl.wel1.ru. It downloads a platform-specific binary (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe), writes it to /var/tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh or cmd.exe /c start /b, using a marker file to suppress repeat execution. A DNS-TXT channel reassembles base64 chunks from sequentially numbered TXT records as a fallback. Cover strings referencing analytics/telemetry/dotnet_diag are misdirection; the destinations are non-publisher, anonymous Cloudflare Workers and Russian DNS hosts, and the fetched bytes are opaque binaries executed on the installer's host. An additional 81 KB lib/telemetry.js is shipped but not reached from index.js or _bridge.js.

References: https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-header/v/35.7.1