MAL-2026-12990
Dashboard / Malicious Package / MAL-2026-12990
MAL-2026-12990
Summary: Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)
Details: Source: amazon-inspector (792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70) On require of the package, index.js loads _runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments (resolving to oob-worker.cf10{0,1,2,3}-*.workers.dev, with DNS TXT-record fallback to *.dl.wel1.ru), downloads a platform-specific binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under disguised filenames (`.cache_<hex>` on Unix, `dotnet_diag_<hex>.exe` on Windows), chmods it to 0755, and spawns it detached via `/bin/sh -c` or `cmd.exe /c start /b`. A second equivalent download-and-execute chain is bundled as lib/telemetry.js (base64 decode → chmodSync 0755 → `cp.spawn('/bin/sh', ['-c', filePath + ' &'])`), framed with SDK-style cover text and using split-string `require("child_"+"process")` to evade static analysis. The package's declared purpose is a `native bridge`, but _runtime.js performs no bridging logic — only the dropper flow.
Affected packages
Package
Name: bnpl-blocks-mobile-bnpl-grid-container
Purl: pkg:npm/bnpl-blocks-mobile-bnpl-grid-container
Affected ranges
Type: N/A
Events:
