MAL-2026-12895

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-star-rating/MAL-2026-12895.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12895
Published
2026-08-05T14:52:50Z
Modified
2026-08-05T15:50:46.800957641Z
Summary
Malicious code in bnpl-blocks-atom-bnpl-star-rating (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (06bdc5da391bdf16afb2eb1cc60461831dc1d7ede9fa817cc842795cb8d2ddda)

On require of the package's main entry, index.js loads shim.js which fetches a platform-specific binary payload (dotnetdiag<rand>.exe on Windows, loadermac /.cache<rand> on POSIX) from hardcoded Cloudflare Workers hosts, writes it to a temp path, chmods 0755, and spawns it detached via childprocess.spawn with unref(). When HTTPS mirrors fail, the loader falls back to a DNS TXT retrieval channel against *.dl.wel1.ru, reading a chunk count from c.<domain> and reassembling sequential N.<domain> TXT records as a base64-encoded payload. C2 hostnames and fallback resolver domains are reconstructed at runtime by.join('') of split-string arrays to defeat static searching, and execution is gated by env-var kill switches (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOTTRACK) and a /tmp/.analyticsstate stamp file for once-per-TTL suppression. The package's declared purpose is a 'star rating abstraction layer,' which does not require fetching or executing an opaque cross-platform binary at load time. The delivered binary runs with the installer's privileges and provides full-host code execution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:52:50Z",
            "id": "IN-MAL-2026-015479",
            "import_time": "2026-08-05T15:19:53.617655694Z",
            "sha256": "06bdc5da391bdf16afb2eb1cc60461831dc1d7ede9fa817cc842795cb8d2ddda",
            "versions": [
                "35.8.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-atom-bnpl-star-rating

Package

Name
bnpl-blocks-atom-bnpl-star-rating
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-atom-bnpl-star-rating

Affected ranges

Affected versions

35.*
35.8.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bnpl-blocks-atom-bnpl-star-rating-35.8.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-irkmmGS/5u25GYa2z1WCdFOj+hY975dSC33eS17Rxiu7iOIqd6+Ne5azHsxJe8qXMVIuG3jvThCIiOpTLQtlvQ==",
                "sha1": "520fc572b85d87e4a547df4a20a40a73dd9f0304"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "91a19596066670188bb0ebe4c7178816f56ff66337808294fb9c65945f7312483b2efc",
            "sha256": "0aa3f045674b3a33368ea2798a676a57244ed2db8f8c089ea6bec25144323c75",
            "path": "_shim.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-star-rating/MAL-2026-12895.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]