MAL-2026-12952

    Dashboard / Malicious Package / MAL-2026-12952

    MAL-2026-12952

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bnpl-blocks-independent-bnpl-cards (npm)

    Details: Source: amazon-inspector (063ad90855d7ee9b794ccc1e32a794000434fb6955e82152a4d4118ff8e3e266) On require of the package, index.js loads _bridge.js which reconstructs attacker-controlled hostnames via array.join("") string splits (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT chunked base64 fallback via *.sdk.dl.wel1.ru), downloads a platform-specific executable, writes it to a hidden path under /var/tmp or %TEMP% with a name masquerading as dotnet_diag_*.exe or.cache_*, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe with.unref(). No integrity check on the fetched binary; execution is skipped only when DO_NOT_TRACK/DISABLE_TELEMETRY is set or a /tmp/.analytics_state marker file exists. Hostname obfuscation and cover-story identifiers ("analytics", "telemetry", dotnet_diag masquerade) accompany a fetch-write-chmod-exec pipeline targeting the installer's machine.

    References: https://www.npmjs.com/package/bnpl-blocks-independent-bnpl-cards/v/35.5.3

    Affected packages

    Package

    Name: bnpl-blocks-independent-bnpl-cards

    Purl: pkg:npm/bnpl-blocks-independent-bnpl-cards

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.5.3