MAL-2026-13025
Dashboard / Malicious Package / MAL-2026-13025
MAL-2026-13025
Summary: Malicious code in bnpl-molecule-mobile-bnpl-onboarding (npm)
Details: Source: amazon-inspector (23d110510740ced78dc5855c7f9c0c3dedff3669ad49cb52aeee3c5467f00d3b) On require of the package, index.js loads _runtime.js which selects a platform-keyed asset (linux/darwin/win32), downloads an opaque binary from one of three string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT-record base64 fallback via wel1.ru subdomains, writes the payload to /var/tmp or %TEMP% under a masquerading filename (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and detached-spawns it via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed by joining split fragments (e.g. ["oob-worker.cf1","00-416.wo","rkers",".d","ev"].join("")) to evade static analysis, and a decoy no-op logger writes empty strings to stderr. The package name impersonates a BNPL onboarding module but ships no such functionality.
Affected packages
Package
Name: bnpl-molecule-mobile-bnpl-onboarding
Purl: pkg:npm/bnpl-molecule-mobile-bnpl-onboarding
Affected ranges
Type: N/A
Events:
