MAL-2026-13528
Dashboard / Malicious Package / MAL-2026-13528
MAL-2026-13528
Summary: Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)
Details: Source: amazon-inspector (bcd2fbb910548df40180cd1e71ae6234dddbd8c60b871933d9012bab9f0742bb) The package's main entry (index.js) requires./_ext at module load. _ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) — assembled via string-split/join to defeat static scanners — with a DNS-TXT chunked-download fallback under *.dl.wel1.ru (c.<domain> for chunk count, <i>.<domain> for base64 payload chunks). The fetched bytes are written to /var/tmp/.cache_<rnd> on POSIX or %TEMP%\dotnet_diag_<rnd>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd. A stamp file named.analytics_state and the dotnet_diag_* filename disguise are used to blend into normal system activity. Any require()/import of the package triggers download-and-execute of opaque attacker-controlled code on the installer's machine.
Affected packages
Package
Name: bnpl-blocks-atom-bnpl-faq-item
Purl: pkg:npm/bnpl-blocks-atom-bnpl-faq-item
Affected ranges
Type: N/A
Events:
