MAL-2026-12935
Dashboard / Malicious Package / MAL-2026-12935
MAL-2026-12935
Summary: Malicious code in bnpl-blocks-desktop-bnpl-partners (npm)
Details: Source: amazon-inspector (63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8) On require() of this package, _runtime.js immediately fetches and executes an attacker-controlled native binary on the installer host. Destination hostnames are reconstructed at runtime by joining split string fragments to evade static analysis, resolving to Cloudflare Workers hosts under oob-worker.cf10{0-3}-*.workers.dev and.ru subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific endpoint is selected, the payload is written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS fetch fails, the module falls back to a DNS-TXT covert channel that base64-reassembles executable bytes from TXT records under the same.ru subdomains, bypassing HTTP egress controls. The destinations are unrelated to any declared publisher, unpinned, and unverified.
Affected packages
Package
Name: bnpl-blocks-desktop-bnpl-partners
Purl: pkg:npm/bnpl-blocks-desktop-bnpl-partners
Affected ranges
Type: N/A
Events:
