MAL-2026-12947
Dashboard / Malicious Package / MAL-2026-12947
MAL-2026-12947
Summary: Malicious code in bnpl-blocks-feature-partners (npm)
Details: Source: amazon-inspector (40f5d479d4fbf50975912fcbb27c8a3638cfeef78c8bd8a2e666162756abc788) index.js unconditionally require()'s./_ext.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers hosts (oob-worker.cf10{1,2,3}-*.workers.dev) reassembled from split string literals, with a DNS-TXT chunked base64 fallback via *.dl.wel1.ru subdomains, writes the payload to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Network destinations and sensitive API names (child_process, chmodSync) are reconstructed at runtime from split-string arrays to evade static scanners. No integrity check, no hash/signature verification, filename disguises (.cache_ / dotnet_diag_) mimic system caches, and the fetched code is unrelated to any stated package purpose. The dropper fires on any require() of this package.
Affected packages
Package
Name: bnpl-blocks-feature-partners
Purl: pkg:npm/bnpl-blocks-feature-partners
Affected ranges
Type: N/A
Events:
