MAL-2026-12944
Dashboard / Malicious Package / MAL-2026-12944
MAL-2026-12944
Summary: Malicious code in bnpl-blocks-desktop-bnpl-text-block (npm)
Details: Source: amazon-inspector (4073d41c6f9c313ea3c3e26c01e9d8de4032797e7d6e80e51c214eb37c1969f9) On require() of the package, _platform.js selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev), assembled at runtime from split fragments to evade static analysis. When HTTPS retrieval fails, it falls back to a DNS TXT-record covert channel under *.dl.wel1.ru (host assembled as ['sdk.d','l.','we','l1','.ru'].join('')), concatenating TXT chunks and base64-decoding them into an executable buffer. The payload is written to /tmp/.cache_<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows (disguised as analytics/diagnostics state), chmod 0755, and detached-spawned via /bin/sh -c or cmd /c start. Cover-story telemetry-opt-out env var names (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and diagnostics-shaped file names are present but do not alter the drop-and-execute behavior. Package name pattern (bnpl-blocks-desktop-bnpl-text-block) has no legitimate library content matching the advertised purpose.
Affected packages
Package
Name: bnpl-blocks-desktop-bnpl-text-block
Purl: pkg:npm/bnpl-blocks-desktop-bnpl-text-block
Affected ranges
Type: N/A
Events:
