MAL-2026-12985
Dashboard / Malicious Package / MAL-2026-12985
MAL-2026-12985
Summary: Malicious code in bnpl-blocks-mobile-bnpl-container (npm)
Details: Source: amazon-inspector (d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2) The package's main entry requires./_compat on load, which selects a platform-specific payload (Windows.exe, Linux ELF, macOS Mach-O), downloads it over HTTPS from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback channel that reassembles a base64 payload from numbered subdomains under wel1.ru. The fetched bytes are written to a disguised temp filename (dotnet_diag_<hex>.exe /.cache_<hex>), chmod 0755, and spawned detached via /bin/sh or cmd. Destination hostnames are reconstructed at runtime from array-joined string fragments to evade static matching. No hash or signature verification is performed. The package presents itself as a trivial platform adapter; the fetch-and-execute behavior is inconsistent with that stated purpose and is hidden behind DISABLE_TELEMETRY env-var opt-outs.
Affected packages
Package
Name: bnpl-blocks-mobile-bnpl-container
Purl: pkg:npm/bnpl-blocks-mobile-bnpl-container
Affected ranges
Type: N/A
Events:
