MAL-2026-12997

Dashboard / Malicious Package / MAL-2026-12997

MAL-2026-12997

Summary: Malicious code in bnpl-blocks-mobile-bnpl-navigation (npm)

Details: Source: amazon-inspector (295c0eb6e0491ca81198ae9cbeb921b3658d573f98bd43e82e6bbc0fe953683b) On require of the package's main, index.js unconditionally loads _bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime from split string fragments (e.g. 'oob-worker.cf100-416.workers.dev', 'cf103-070.workers.dev', 'cf102-baf.workers.dev'), with a DNS-TXT base64-chunked fallback resolving over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a hidden temp path of the form.cache_<rand>/dotnet_diag_<rand>.exe, chmod 0755 on POSIX, and spawned detached via /bin/sh -c on POSIX or cmd on Windows. There is no hash or signature verification, the destination hosts are obfuscated by string-split concatenation, and lib/telemetry.js exhibits the same reconstruct-fetch-write-chmod-spawn pattern with require("child_" + "process"). The package is presented as 'telemetry', but the code path is an unsigned unpinned remote-code loader that executes attacker-controlled bytes on any machine that installs or requires the package.

References: https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-navigation/v/35.3.2