MAL-2026-12886

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-product-card/MAL-2026-12886.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12886
Published
2026-08-05T14:54:33Z
Modified
2026-08-05T15:50:42.842137278Z
Summary
Malicious code in bnpl-blocks-atom-bnpl-product-card (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45)

index.js requires./bootstrap.js on load. bootstrap.js selects a per-OS asset path, then attempts to download an opaque binary from a rotated list of split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). On failure it falls back to a DNS-TXT covert channel reassembling a base64 payload from TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The bytes are written to a disguised path in /var/tmp or %TEMP% (.cache<uid> on POSIX, dotnetdiag<uid>.exe on Windows), chmod 0o755 on POSIX, and detached-spawned via /bin/sh -c '<file> &' or cmd /c start /b. Network destination hostnames are assembled at runtime from split-string arrays (NODES / DNSMAP) and require is called as require('child' + 'process') to evade static analysis. On-disk artifact names and env-var opt-outs (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOTTRACK) impersonate a benign telemetry SDK, and lib/telemetry.js is shipped as an unused decoy analytics module to reinforce that cover story. No hash verification, no signature check, and no publisher match between the fetched binary and the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015491",
            "import_time": "2026-08-05T15:19:54.166489888Z",
            "sha256": "66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45",
            "modified_time": "2026-08-05T14:54:33Z",
            "versions": [
                "35.6.4"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-atom-bnpl-product-card

Package

Name
bnpl-blocks-atom-bnpl-product-card
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-atom-bnpl-product-card

Affected ranges

Affected versions

35.*
35.6.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-IrLQEdwHiSJplnyfKGbw5jBDnniw9Jva3wtNwuiUcEniNe2p1UKA0sZWblrPV/w+LkY95QxiN925F6dAcoZwJw==",
                "sha1": "267b99f47ea0c45f3ce874a53b19f60ec3da2c29"
            },
            "filename": "bnpl-blocks-atom-bnpl-product-card-35.6.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "sha256": "205a1f13851c82b34c130fc50882c1996cbf4fb157c115c30d325bb9243dff6d",
            "tlsh": "92a1869a156670188b70dbe486174816f65bf6a33680c6c4fbac59981f7712483b2dfc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-product-card/MAL-2026-12886.json"