MAL-2026-12938

    Dashboard / Malicious Package / MAL-2026-12938

    MAL-2026-12938

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bnpl-blocks-desktop-bnpl-reviews (npm)

    Details: Source: amazon-inspector (eaa5e2ca983c49eefb3d32e333435a236f63c2d896ac41aed7b56114c477964c) On require, index.js loads _init.js which reconstructs a set of hostnames from split-string fragments (e.g. 'oob-worker.cf103-','070','.wo','rker','s.dev' and 'sdk.dl','.wel1.','ru'), downloads a per-architecture binary over HTTPS, writes it to /var/tmp or %TEMP% under a disguised name (dotnet_diag_<rnd>.exe or.cache_<rnd>), chmods it 0755, and spawns it detached via child_process spawn('/bin/sh', ['-c', <path>+' &']) or spawn('cmd',...). If the HTTPS fetch fails, the loader queries DNS TXT records at c.<domain> for a chunk count and then j.<domain> to reassemble a base64-encoded payload, providing a covert delivery channel that bypasses HTTP egress filters. The child_process module name and destination hostnames are both split and joined at runtime to evade static analysis, and a cover-story 'analytics_state' / 'DISABLE_TELEMETRY' TTL marker is used to disguise intent. This behavior fires automatically on module load with no relation to any advertised package purpose.

    Affected packages

    Package

    Name: bnpl-blocks-desktop-bnpl-reviews

    Purl: pkg:npm/bnpl-blocks-desktop-bnpl-reviews

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.6.5
    MAL-2026-12938 | CVE-DB