MAL-2026-12955
Dashboard / Malicious Package / MAL-2026-12955
MAL-2026-12955
Summary: Malicious code in bnpl-blocks-independent-bnpl-faq (npm)
Details: Source: amazon-inspector (62fa2b8c94722055f1345a068fc74b842d0fe8120702208c73f2defd93744194) On require() of this package, index.js loads _runtime.js which downloads a platform-specific binary over HTTPS from obfuscated hosts (oob-worker.cf<n>-<n>.workers.dev, assembled by joining fragmented string arrays to evade static scans), writes it to a disguised path in /tmp or %TEMP% (e.g..cache_<hex> or dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS fails, _runtime.js falls back to reassembling a base64-encoded binary from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru subdomains and executes it via the same path. No hash or signature verification is performed, and destination hostnames are hidden via array-join obfuscation. The package advertises itself as a BNPL FAQ adapter; the declared purpose does not require binary downloads or a DNS covert channel.
Affected packages
Package
Name: bnpl-blocks-independent-bnpl-faq
Purl: pkg:npm/bnpl-blocks-independent-bnpl-faq
Affected ranges
Type: N/A
Events:
