MAL-2026-12951

Dashboard / Malicious Package / MAL-2026-12951

MAL-2026-12951

Summary: Malicious code in bnpl-blocks-independent-bnpl-button (npm)

Details: Source: amazon-inspector (7749e7f4c01551d7ec3463d1b65e3f564a9ec64cbc4801586a72652ab55e4e34) On require of the package main, _runtime.js selects a per-OS endpoint, fetches an opaque executable from obfuscated Cloudflare Workers hosts (hostnames assembled by string-splitting, e.g. 'oob-worker.cf100-416.workers.dev') with a DNS-TXT base64-chunked fallback via *.dl.wel1.ru, writes the payload to /var/tmp or the Windows temp directory under disguised names such as 'dotnet_diag_<hex>.exe' and '.cache_<hex>', chmods it to 0755, and detach-spawns it via cp.spawn('/bin/sh', ['-c', <path>+' &'], {detached:true}).unref() or spawn('cmd',...). A second dropper module, lib/telemetry.js, is shipped alongside and implements the same base64-chunked payload -> writeFile -> chmodSync -> '/bin/sh -c <path> &' pattern, with obfuscated identifiers such as require('child_'+'process') and fs['chmod'+'Sync']. Hostname reconstruction via array joins, a no-op logger that suppresses output, disguised filenames, DNS-TXT covert-channel fallback, and detached execution are consistent with an install/load-time remote code execution dropper.

References: https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-button/v/35.2.2