MAL-2026-12884

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-notification/MAL-2026-12884.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12884
Published
2026-08-05T14:55:25Z
Modified
2026-08-05T15:50:41.538946879Z
Summary
Malicious code in bnpl-blocks-atom-bnpl-notification (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (80f343dda3cb4e6b3420db34a6a801aeeeaf60ecf1ea23ad78de4c7605b954d2)

index.js unconditionally requires./runtime on load. runtime.js reconstructs Cloudflare Workers hostnames (oob-worker.cf10{1,2,3}-*.workers.dev) via string-split/array-join obfuscation, with a DNS-TXT chunked-base64 fallback channel keyed on platform, downloads platform-specific opaque bytes over HTTPS, writes them to /var/tmp or %TEMP% under cover names such as.cache<hex> or dotnetdiag<hex>.exe, chmods 0755 on POSIX, and spawns the payload detached via /bin/sh -c 'path &' or cmd.exe /c start. lib/telemetry.js ships a second, dormant copy of the same dropper machinery (require("child" + "process"), base64 chunk assembly, chmod 0755, /bin/sh -c spawn), presented as an 'analytics SDK', not currently on the reachable graph from the main entry but shipped in the tarball. The package name presents as a BNPL UI notification block; the actual behavior on require is fetch-and-execute of attacker-controlled bytes, which is unrelated to any legitimate purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:55:25Z",
            "id": "IN-MAL-2026-015497",
            "import_time": "2026-08-05T15:19:54.615083266Z",
            "versions": [
                "35.3.8"
            ],
            "source": "amazon-inspector",
            "sha256": "80f343dda3cb4e6b3420db34a6a801aeeeaf60ecf1ea23ad78de4c7605b954d2"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-atom-bnpl-notification

Package

Name
bnpl-blocks-atom-bnpl-notification
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-atom-bnpl-notification

Affected ranges

Affected versions

35.*
35.3.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-NuRLOzyUQDPvCYdbqzphkLYiDWDcr0AqPq7GMdTbhilvSx3AQl74oGiMu4B1vIHguoBj/7mhCBQouERtpanu/w==",
                "sha1": "abd6084e57047a451f6b3ab4934847b544f92600"
            },
            "filename": "bnpl-blocks-atom-bnpl-notification-35.3.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_runtime.js",
            "tlsh": "9fa18496156ab0184b70ebf4c6178826fa5bf6a33281c284f75c95945f7312482b2efc",
            "sha256": "d13ff2d356733af74235bd492e99d198ba1752aa7948a32accd0480f67d88c85"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "be835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "6a331dedd2530f797e2f770ad8f15ed47a7c301ae70489fec0de63aabd28643e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-notification/MAL-2026-12884.json"