MAL-2026-12384

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/form-bnpl-dolyame-component-object/MAL-2026-12384.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12384
Published
2026-08-05T12:45:16Z
Modified
2026-08-05T13:35:28.251800827Z
Summary
Malicious code in form-bnpl-dolyame-component-object (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (06f48cc3ab15e35aac9a2c38a8f16c695d84e17e2b742e99f5b0c0a3947a6cda)

On require() of the package, polyfill.js selects a platform-specific binary and downloads it over HTTPS from Cloudflare Workers subdomains whose hostnames are assembled via array-join string splits to defeat static detection (e.g. oob-worker.cf102-baf.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev, cf99-9b3.workers.dev), with a DNS-TXT fallback under *.dl.well1.site. The downloaded bytes are written to /tmp or %TEMP% under a disguised name (dotnetdiag<hex>.exe on Windows,.cache<hex> on Unix), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or cmd.exe start /b. Environment-variable names such as DISABLETELEMETRY, ANALYTICSOPTOUT, and DONOTTRACK are used as a cover story alongside an analyticsstate TTL stamp. A second 81KB lib/telemetry.js bundle ships alongside containing the same cp.spawn + chmod 755 dropper pattern. The package's declared purpose is a BNPL form component, which does not require downloading and executing platform-specific binaries from anonymous workers.dev hosts.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "06f48cc3ab15e35aac9a2c38a8f16c695d84e17e2b742e99f5b0c0a3947a6cda",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T13:08:43.057611801Z",
            "modified_time": "2026-08-05T12:45:16Z",
            "versions": [
                "20.8.9"
            ],
            "id": "IN-MAL-2026-014747"
        }
    ]
}
References
Credits

Affected packages

npm / form-bnpl-dolyame-component-object

Package

Name
form-bnpl-dolyame-component-object
View open source insights on deps.dev
Purl
pkg:npm/form-bnpl-dolyame-component-object

Affected ranges

Affected versions

20.*
20.8.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "67133823bdc49e4f92ac7fde902d448e31cb647a",
                "sha512_sri": "sha512-1scVKZcQRyx1QU+r+u/SrGS8J7/okB281lNf/CnyoSbq7nupv/2NA+FJiYOaZtVrRS19rBAdTyjoUHZ+r7ccyw=="
            },
            "filename": "form-bnpl-dolyame-component-object-20.8.9.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "sha256": "ffce6cdd3ff3ea67f9cbd413a52513625af6562e6e3702bf48c0c9bf4c06b6c3",
            "tlsh": "d0a1a99a15a9701d47b0d7e48b274416f657f663378082d0f76ca5845fb712483b1dfc"
        },
        {
            "path": "lib/telemetry.js",
            "sha256": "9f45e719a595095287211a050ede0a1c0682b729f6bceb3a2a001cffeaa3afbf",
            "tlsh": "47835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/form-bnpl-dolyame-component-object/MAL-2026-12384.json"