MAL-2026-12979

    Dashboard / Malicious Package / MAL-2026-12979

    MAL-2026-12979

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bnpl-blocks-mobile-bnpl-article-author (npm)

    Details: Source: amazon-inspector (1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd) On require of the package, index.js loads _shim.js which reconstructs a set of Cloudflare Workers hostnames (oob-worker.cf101-adf/102-baf/99-9b3/103-070.workers.dev) and DNS-TXT fallback domains (sdk/ext/pkg/net.dl.wel1.ru) from array fragments joined at runtime, downloads an opaque binary over HTTPS (with a DNS-TXT chunked base64 covert channel as fallback when HTTPS egress is blocked), writes it to /tmp or the Windows temp directory under disguised names such as.cache_<rnd> or dotnet_diag_<rnd>.exe, chmods it to 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd /c start. Destination hostnames are obfuscated via string-split-and-join to evade static detection. Installing or importing this package results in execution of attacker-controlled native code on the host with the installer's privileges.

    References: https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-article-author/v/35.3.3

    Affected packages

    Package

    Name: bnpl-blocks-mobile-bnpl-article-author

    Purl: pkg:npm/bnpl-blocks-mobile-bnpl-article-author

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.3.3