MAL-2026-12976
Dashboard / Malicious Package / MAL-2026-12976
MAL-2026-12976
Summary: Malicious code in bnpl-blocks-markdown (npm)
Details: Source: amazon-inspector (161162281afaf68fd193e2521beaf60d32c850e29cc276192497eee09646a55a) On require('bnpl-blocks-markdown'), index.js loads _bootstrap.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers hosts (strings such as ['oob-worker.cf100-416.workers','.d','ev'].join('') and ['sdk.dl.','wel','1.r','u'].join('')), with a base64-over-DNS-TXT fallback channel via wel1.ru subdomains. The fetched bytes are written to /tmp or %TEMP% under disguised filenames mimicking system tools (e.g..cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd. Env-var names DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK and filenames like analytics_state are cover-story framing; the package's advertised purpose is a markdown utility, which has no need to fetch and execute an arch-specific native binary from obfuscated hosts at import time. This is a classic import-time dropper with attacker-controlled code execution on the installer's host.
Affected packages
Package
Name: bnpl-blocks-markdown
Purl: pkg:npm/bnpl-blocks-markdown
Affected ranges
Type: N/A
Events:
