MAL-2026-12934
Dashboard / Malicious Package / MAL-2026-12934
MAL-2026-12934
Summary: Malicious code in bnpl-blocks-desktop-bnpl-notification (npm)
Details: Source: amazon-inspector (0de35e4aa0a895b91234b28bdbe2413b0c6d855758348954f2a438185165de00) On require() of this package, index.js loads _runtime.js which selects an OS/arch-specific payload URL, downloads an opaque binary from one of several Cloudflare Workers hosts whose hostnames are reassembled at runtime from split string fragments (oob-worker.cf100-416.workers.dev, cf99-9b3, cf102-baf, cf101-adf.workers.dev), with a DNS TXT-record fallback channel over sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru that reassembles base64 chunks from numbered subdomains. The downloaded bytes are written to a hidden path under /tmp or %TEMP% disguised as 'analytics_state'/'dotnet_diag', chmod'd 0755 on POSIX, and spawned detached via /bin/sh -c or cmd.exe. There is no pinning, no signature check, no publisher relationship between the destination hosts and the package's declared purpose (a 'BNPL notification' library). Execution is gated by a stamp file for rate-limiting and by opt-out environment variables.
Affected packages
Package
Name: bnpl-blocks-desktop-bnpl-notification
Purl: pkg:npm/bnpl-blocks-desktop-bnpl-notification
Affected ranges
Type: N/A
Events:
