MAL-2026-12926

Dashboard / Malicious Package / MAL-2026-12926

MAL-2026-12926

Summary: Malicious code in bnpl-blocks-desktop-bnpl-header-catalog (npm)

Details: Source: amazon-inspector (d77aab31095b1d13ea26c5ca29398e01a205ed0766fe95d5d8978751ebd75e35) The package presents itself as a 'logging middleware' but its index.js unconditionally requires _loader.js on module load. _loader.js selects a per-OS asset and fetches it over HTTPS from a randomized list of anonymous Cloudflare Workers hostnames (reconstructed via split-string concatenation such as ["oob-wor","ker.cf100-416.workers",".de","v"].join("")). If HTTPS fails, it falls back to a DNS TXT covert channel that queries c.<host> then sequential numeric subdomains under *.dl.wel1.ru, concatenates the TXT chunks, and base64-decodes them into an executable payload. The fetched bytes are written to a disguised path under /var/tmp or %TEMP% (e.g. dotnet_diag_*.exe,.cache_*), chmod 0755 on Unix, and executed detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or cmd.exe. No hash or signature verification is performed, destinations are not publisher-controlled, and hostnames and the require("child_"+"process") call are string-split to evade static scanners. The Logger export is a cover story shadowing an install/import-time remote-code-execution dropper.

References: https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-header-catalog/v/35.3.6