MAL-2026-12980
Dashboard / Malicious Package / MAL-2026-12980
MAL-2026-12980
Summary: Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)
Details: Source: amazon-inspector (84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb) index.js requires./_loader on load. _loader.js assembles network destinations at runtime by concatenating split string fragments (e.g. ['oob-worker.cf103','-070.worke','rs','.dev'].join('')) to hide endpoints on oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, and falls back to a DNS-TXT covert delivery channel at *.dl.wel1.ru that reads a chunk count from c.<domain> and reassembles base64 payload chunks from numbered subdomains. The downloaded opaque, unpinned, unverified binary is written to /var/tmp or %TEMP% under cover-story names ('dotnet_diag_<hex>.exe', '.cache_<hex>', 'analytics_state'), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. The dropper honors DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables to suppress execution as an anti-analysis measure. The package's stated purpose ('device integration') is unrelated to the fetched executable and no legitimate functionality is shipped.
Affected packages
Package
Name: bnpl-blocks-mobile-bnpl-breadcrumbs
Purl: pkg:npm/bnpl-blocks-mobile-bnpl-breadcrumbs
Affected ranges
Type: N/A
Events:
