MAL-2026-12885

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-popup/MAL-2026-12885.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12885
Published
2026-08-05T14:54:50Z
Modified
2026-08-05T15:50:42.654736468Z
Summary
Malicious code in bnpl-blocks-atom-bnpl-popup (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb)

On require() of this package, index.js loads shim.js which assembles obfuscated non-publisher URLs by joining split string fragments (resolving to a *.workers.dev host, with a DNS-TXT covert-channel fallback under a.ru domain that reconstructs a payload from base64-encoded TXT records at c.<domain> and <i>.<domain>). shim.js downloads a platform-specific binary, writes it to /tmp or %TEMP% under a disguised filename (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmods 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref() (or the cmd equivalent). No hash or signature verification is performed. A second copy of the dropper is shipped in lib/telemetry.js (labeled as an 'Analytics SDK') using the same shape with split-string API names such as require('child'+'process') and fs['chmod'+'Sync']; it is not wired into the current entry point but stages the same capability. The destination hosts are not first-party to the package, and the string-splitting plus DNS-TXT channel are anti-analysis tradecraft rather than legitimate telemetry configuration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:54:50Z",
            "import_time": "2026-08-05T15:19:54.345482751Z",
            "versions": [
                "35.4.7"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015493",
            "sha256": "6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-atom-bnpl-popup

Package

Name
bnpl-blocks-atom-bnpl-popup
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-atom-bnpl-popup

Affected ranges

Affected versions

35.*
35.4.7

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-popup/MAL-2026-12885.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "84a1859a166a71188bb097e487275816f55ff6633380c2d4fb9ca5884f7612483b2efc",
            "path": "_shim.js",
            "sha256": "0e144270d954fa7a1567a909f5b094a8bb1f30b9ce629d2dceb3a52f20cae62a"
        },
        {
            "tlsh": "13835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc",
            "path": "lib/telemetry.js",
            "sha256": "0166680cee7d2b69ebc99577c9096e344a7511e7911e6de5052d2d8f9ac0d0db"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-KU6BH+MKVKwT074nd3drSxcgHADTacH8gLAYrHkQP7Y2oeuWhGPosUhFvy8+j7/Z3ROxYAFeHeoDOiMywPA0jg==",
                "sha1": "3f974a37c5bfd5ce0c60de357c38381b1d183419"
            },
            "filename": "bnpl-blocks-atom-bnpl-popup-35.4.7.tgz"
        }
    ]
}