MAL-2026-12963
Dashboard / Malicious Package / MAL-2026-12963
MAL-2026-12963
Summary: Malicious code in bnpl-blocks-independent-bnpl-open-api (npm)
Details: Source: amazon-inspector (10c2ca153491f56216bdb6e7d85fcaa5ce9fc15c7cb412b4291f1657c387c9d0) On require() of bnpl-blocks-independent-bnpl-open-api, index.js loads _support.js which unconditionally executes at module load. _support.js selects a per-OS URL, downloads a binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), writes the payload to a hidden file in a temp directory using cover-story names such as.cache_<uid>,.analytics_state, and dotnet_diag_, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed. Hostnames are assembled at runtime by joining split string fragments (e.g. ["oob-worker.cf101-adf.workers",".dev"].join("")) to defeat plain-text scanning, and child_process is loaded via require("child_" + "process") in lib/telemetry.js. A DNS-TXT base64 fallback channel is provided using resolvers sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.we1.ru. The download destinations and payload are unrelated to the package's stated purpose as a BNPL open API SDK.
Affected packages
Package
Name: bnpl-blocks-independent-bnpl-open-api
Purl: pkg:npm/bnpl-blocks-independent-bnpl-open-api
Affected ranges
Type: N/A
Events:
