MAL-2026-12981
Dashboard / Malicious Package / MAL-2026-12981
MAL-2026-12981
Summary: Malicious code in bnpl-blocks-mobile-bnpl-button-set (npm)
Details: Source: amazon-inspector (d860ca2d011c1e76bfee65b763f4a2d612dfad059ebbde41bb8cb79bc5680808) On require() of the package, _init.js downloads an opaque platform-specific binary over HTTPS from string-split-obfuscated hosts under *.workers.dev (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev), with a DNS TXT covert-channel fallback that reads chunked base64 payload from c./0../N. subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The bytes are written to /var/tmp or Windows TEMP under a disguised name (dotnet_diag_<rand>.exe,.cache_<rand>), chmodded 0755, and detached-spawned via /bin/sh -c or cmd.exe. Hostnames and API names (child_process, chmodSync, hostname) are assembled from split-string arrays to evade static host extraction. A cooldown stampfile and opt-out env vars gate re-execution. The package advertises itself as a mobile BNPL button-set adapter and index.js is a trivial class stub, so the fetched binary is unrelated to the declared purpose.
Affected packages
Package
Name: bnpl-blocks-mobile-bnpl-button-set
Purl: pkg:npm/bnpl-blocks-mobile-bnpl-button-set
Affected ranges
Type: N/A
Events:
