MAL-2026-13023

    Dashboard / Malicious Package / MAL-2026-13023

    MAL-2026-13023

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bnpl-core (npm)

    Details: Source: amazon-inspector (b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc) index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins (e.g. oob-worker.cf102-baf.workers.dev, cf100-416, cf99-9b3, cf101-adf under workers.dev) and, if HTTPS fetches fail, retrieves a base64-chunked payload over DNS TXT records under *.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under names masquerading as system tooling (dotnet_diag_<hex>.exe,.cache_<hex>), chmodded 0755 on POSIX, and spawned detached via cmd.exe /c start /b or /bin/sh -c. A TTL lock file at /tmp/.analytics_state throttles re-execution. package.json advertises a 'core runtime' with an empty dependency set and a trivial BnplCore init/version/configure surface as a cover story; DISABLE_TELEMETRY-style env checks reinforce the disguise. The host is anonymous Cloudflare Workers infrastructure with no publisher relationship, the fetch is unpinned and unverified, and the payload is opaque.

    References: https://www.npmjs.com/package/bnpl-core/v/35.8.2

    Affected packages

    Package

    Name: bnpl-core

    Purl: pkg:npm/bnpl-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.2
    MAL-2026-13023 | CVE-DB