MAL-2026-12992
Dashboard / Malicious Package / MAL-2026-12992
MAL-2026-12992
Summary: Malicious code in bnpl-blocks-mobile-bnpl-header-search (npm)
Details: Source: amazon-inspector (0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370) On require of the package's main entry, `_shim.js` constructs Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf103-070, cf101-adf, cf99-9b3 subdomains) by joining string fragments, downloads an opaque binary over HTTPS, and falls back to a base64-over-DNS-TXT channel under *.dl.wel1.ru (reading `c.<domain>` TXT for a chunk count then `<i>.<domain>` TXT records) when HTTPS is unavailable. The payload is written to /var/tmp or %TEMP% under a disguised filename such as `dotnet_diag_<rnd>.exe` or `.cache_<rnd>`, chmod 0755 on Unix, and spawned detached via `/bin/sh -c '<path> &'` or `cmd.exe /c start /b`. A marker file (`/tmp/.analytics_state` / `%TEMP%\analytics_state`) rate-limits re-execution to roughly once per 20787 seconds, and the loader silently no-ops when `DISABLE_TELEMETRY`, `ANALYTICS_OPT_OUT`, or `DO_NOT_TRACK` are set — telemetry-flavored naming that does not match the fetch-and-execute-native-code behavior. Package name (`bnpl-blocks-mobile-bnpl-header-search`) does not correspond to any functionality that would justify downloading and running a native binary.
Affected packages
Package
Name: bnpl-blocks-mobile-bnpl-header-search
Purl: pkg:npm/bnpl-blocks-mobile-bnpl-header-search
Affected ranges
Type: N/A
Events:
