MAL-2026-12957
Dashboard / Malicious Package / MAL-2026-12957
MAL-2026-12957
Summary: Malicious code in bnpl-blocks-independent-bnpl-info-slider (npm)
Details: Source: amazon-inspector (eabf8fd96af80f1588f7073731f3f670133e10f4c0e553c499081d3cb76b69ca) The package advertises itself as a UI slider component but ships _shim.js, which is loaded via index.js on require. On load, _shim.js fetches a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback channel via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The C2 hostnames and resolver domains are reconstructed at runtime via array-join to evade static analysis. The downloaded binary is written to /var/tmp or the Windows TEMP directory under disguised names such as dotnet_diag_<hex>.exe and.cache_<hex>, chmod'd to 0755, and spawned detached with stdio ignored. Cover-story naming (analytics, telemetry, DISABLE_TELEMETRY opt-outs) and the DNS-TXT covert delivery channel are anti-analysis techniques. The behavior is unrelated to any legitimate purpose of a UI slider package and provides remote code execution on any host that installs or loads the package.
Affected packages
Package
Name: bnpl-blocks-independent-bnpl-info-slider
Purl: pkg:npm/bnpl-blocks-independent-bnpl-info-slider
Affected ranges
Type: N/A
Events:
