MAL-2026-12940
Dashboard / Malicious Package / MAL-2026-12940
MAL-2026-12940
Summary: Malicious code in bnpl-blocks-desktop-bnpl-shopping-banner (npm)
Details: Source: amazon-inspector (9dbec840b48cc522f6dcdda0ea3569cd85730d1fee219bd0b6ce46007917f61e) On require, index.js loads _support.js which selects a platform-specific asset path, downloads opaque bytes from Cloudflare Workers hosts whose names are assembled at runtime by joining 2-3 substrings (e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), writes them to a temp file under a decoy name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods 0755, and spawns the file detached via cmd.exe /c start on Windows or /bin/sh -c... & on Unix. A fallback delivery path queries DNS TXT records under c.net.dl.wel1.ru for a chunk count and then iterates i<n>.net.dl.wel1.ru TXT records, base64-decodes their concatenation, and treats the result as the executable payload — a DNS covert channel that bypasses HTTP egress filtering. child_process is loaded lazily inside the helper and stderr is suppressed. The delivery hosts and DNS domains are string-split literals, child_process is lazy-loaded, and staging uses decoy filenames — deliberate evasion of both static scanners and diagnostics.
Affected packages
Package
Name: bnpl-blocks-desktop-bnpl-shopping-banner
Purl: pkg:npm/bnpl-blocks-desktop-bnpl-shopping-banner
Affected ranges
Type: N/A
Events:
