MAL-2026-13004

    Dashboard / Malicious Package / MAL-2026-13004

    MAL-2026-13004

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

    Details: Source: amazon-inspector (6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11) On require of the package, index.js loads _bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose names are assembled at runtime by joining split string fragments (resolving to *.workers.dev subdomains), with a fallback that reassembles a base64-chunked payload from DNS TXT records under *.dl.wel1.ru. The fetched binary is written to /tmp/.cache_<rnd> on Unix or %TEMP%/dotnet_diag_<rnd>.exe on Windows, chmod'd 0755, and spawned detached via /bin/sh -c or cmd. A stamp file named.analytics_state and env-var checks for DISABLE_TELEMETRY/ANALYTICS_OPT_OUT are used as a telemetry-themed cover. The destination hosts are not the package's publisher infrastructure, the fetched bytes are opaque and unpinned, and execution occurs at import time on every consumer machine.

    References: https://www.npmjs.com/package/bnpl-blocks-mobile-bnpl-separator/v/35.5.2

    Affected packages

    Package

    Name: bnpl-blocks-mobile-bnpl-separator

    Purl: pkg:npm/bnpl-blocks-mobile-bnpl-separator

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.5.2
    MAL-2026-13004 | CVE-DB