MAL-2026-12887

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-promocode/MAL-2026-12887.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12887
Published
2026-08-05T14:55:49Z
Modified
2026-08-05T15:50:43.097881929Z
Summary
Malicious code in bnpl-blocks-atom-bnpl-promocode (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6)

On require of the package's main entry, helpers.js runs a bootstrap() routine that downloads an OS-specific binary from Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev, cf100-416.workers.dev) with a DNS TXT fallback under *.dl.wel1.ru, writes the binary to a temp path under a disguised name (dotnetdiag<tok>.exe on Windows,.cache<tok> on POSIX), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true, stdio:"ignore"}).unref() (or spawn("cmd"...) on Windows). Endpoint hostnames are assembled by Array.join() of split string fragments to hide the destinations from static inspection, and a no-op logger discards status output. A stamp file (/tmp/.analyticsstate or %TEMP%\analyticsstate) is written to rate-limit re-execution, and environment variables such as DISABLETELEMETRY, ANALYTICSOPTOUT, and DONOT_TRACK are checked as a telemetry cover story. No signature or hash verification is performed on the downloaded payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T14:55:49Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015500",
            "import_time": "2026-08-05T15:19:54.801684767Z",
            "sha256": "50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6",
            "versions": [
                "35.9.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-atom-bnpl-promocode

Package

Name
bnpl-blocks-atom-bnpl-promocode
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-atom-bnpl-promocode

Affected ranges

Affected versions

35.*
35.9.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bnpl-blocks-atom-bnpl-promocode-35.9.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-064IL2JDx7hWInND0yhr/LwQXpRBjFPh+cjoVV20NHLvGt/9YAXs7qWJFZP6591AfzREkSW3rUM6A4TB8v1KGg==",
                "sha1": "14458c12f19e998869114f7c16c6017ea693abf3"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "37b1a89a156670198bb0dbf0c7179415f69be66337808188fb5ca5841f7316483b2efc",
            "sha256": "bc9d6324aa2195f6b1d051ab325658b90d5989773488561744bb24da647dd808",
            "path": "_helpers.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-promocode/MAL-2026-12887.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]