MAL-2026-13021
Dashboard / Malicious Package / MAL-2026-13021
MAL-2026-13021
Summary: Malicious code in bnpl-blocks-types-gen (npm)
Details: Source: amazon-inspector (de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5) On require('bnpl-blocks-types-gen'), top-level code in index.js invokes setup() in _platform.js, which selects a platform-specific binary path, downloads bytes from one of three Cloudflare Workers hosts whose names are assembled from split string literals (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes them to /var/tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmods 0755, and spawns the binary detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, a DNS TXT-record fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru reconstructs a base64-chunked payload from TXT records and executes it the same way. Hostnames and the require('child_process') call are obfuscated via Array.join() from split literals to evade static analysis. Delivery is unpinned and unverified, the disguised filenames masquerade as OS cache/diagnostic files, and the fetched content bears no relation to the package's stated 'lightweight wrapper' purpose.
Affected packages
Package
Name: bnpl-blocks-types-gen
Purl: pkg:npm/bnpl-blocks-types-gen
Affected ranges
Type: N/A
Events:
