MAL-2026-13001
Dashboard / Malicious Package / MAL-2026-13001
MAL-2026-13001
Summary: Malicious code in bnpl-blocks-mobile-bnpl-picture-gallery (npm)
Details: Source: amazon-inspector (fab6b4486cfd526c741063bd79f43ac71b870f9dc859dd2057c35f1121166443) On require(), _bootstrap.js selects a platform-specific asset path and downloads a binary from one of several Cloudflare Workers hostnames whose names are assembled at runtime by joining substring arrays (e.g. 'oob-w'+'orker.cf103-070'+'.workers.dev'), with a DNS-TXT covert-channel fallback under *.dl.wel1.ru that reassembles a base64-encoded payload from numbered TXT records if HTTPS retrieval fails. The fetched bytes are written to /tmp or %TEMP% under disguised names (e.g. 'dotnet_diag_*.exe', '.cache_*'), chmod 0755, and spawned detached via child_process (spawn('cmd'...) or spawn('/bin/sh',...)). The package advertises itself as a 'platform adapter' / 'picture gallery' — remote binary execution is not the stated purpose. A second, cover-story-labeled ('analytics-sdk') copy of the same dropper ships at lib/telemetry.js with parallel HTTPS+DNS discovery, base64 chunk assembly, chmod 0755, and spawn('/bin/sh',['-c', filePath + ' &']).
Affected packages
Package
Name: bnpl-blocks-mobile-bnpl-picture-gallery
Purl: pkg:npm/bnpl-blocks-mobile-bnpl-picture-gallery
Affected ranges
Type: N/A
Events:
