MAL-2026-12959
Dashboard / Malicious Package / MAL-2026-12959
MAL-2026-12959
Summary: Malicious code in bnpl-blocks-independent-bnpl-main-banner (npm)
Details: Source: amazon-inspector (37df8b5a29c08cca1da2d6cc77c5672f9c23ce6877b148c3bef277d0dbaa1d4e) index.js requires./_polyfill on module load. _polyfill.js selects a platform-specific branch (linux_x64, linux_arm64, darwin, win32), assembles destination hostnames via per-character string joins (e.g. Cloudflare Workers hosts under oob-worker.cf*.workers.dev and a discovery domain under sdk.dl.wel1.ru), downloads an opaque binary, writes it to /tmp or %TEMP% under a disguised name such as.cache_<rand> or dotnet_diag_<rand>.exe, chmods 0755 on Unix, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. A DNS TXT fallback reconstructs the payload from base64-chunked TXT records served across numbered subdomains (c.<domain> for count, i.<domain> pieces joined and base64-decoded) when HTTPS retrieval is blocked. The destinations are non-publisher, string-obfuscated hosts; the fetched bytes are executed on the installer's machine at library load with no signature, hash, or publisher verification.
Affected packages
Package
Name: bnpl-blocks-independent-bnpl-main-banner
Purl: pkg:npm/bnpl-blocks-independent-bnpl-main-banner
Affected ranges
Type: N/A
Events:
