MAL-2026-12908

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-consts/MAL-2026-12908.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12908
Published
2026-08-05T14:51:16Z
Modified
2026-08-05T15:50:53.309038459Z
Summary
Malicious code in bnpl-blocks-consts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede)

Package is advertised as a constants wrapper but requiring it loads polyfill.js, which on import asynchronously downloads a platform-specific executable, writes it to /tmp (Unix) or the Windows TEMP directory under decoy names (dotnetdiag<hex>.exe,.cache<hex>,.analyticsstate), chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start (spawn calls at polyfill.js lines 121 and 125; childprocess required at line 119). Payload host list is assembled at runtime by split-join to defeat static string scanning, resolving to Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf102-baf.workers.dev. When HTTPS fetches fail, the code queries a DNS TXT chunk-count record at c.<domain> and then loops through 0.<domain>..N-1.<domain> under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, base64-concatenates the TXT payload, and executes the reconstructed binary. The dropper honors DONOTTRACK / DISABLETELEMETRY environment variables to masquerade as telemetry. Purpose (a trivial constants module) is inconsistent with fetch-and-execute of an opaque binary from obfuscated hosts, and every distinguishing signal (host string-splitting, decoy artifact names, DNS covert-channel fallback, detached spawn) is characteristic of a supply-chain implant.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015468",
            "import_time": "2026-08-05T15:19:53.078006068Z",
            "sha256": "7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede",
            "modified_time": "2026-08-05T14:51:16Z",
            "source": "amazon-inspector",
            "versions": [
                "35.1.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-consts

Package

Name
bnpl-blocks-consts
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-consts

Affected ranges

Affected versions

35.*
35.1.9

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "tlsh": "4da1745a16a670188bb097e486275416f65fe6633380c2d4f7aca9981f722248372efc",
            "sha256": "910762360e03f3227df1db030cc27a05e441d42b426086c3458eeb0379046642"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-consts-35.1.9.tgz",
            "hashes": {
                "sha1": "bfc26a36d203c5f58830672281454ac14bd65653",
                "sha512_sri": "sha512-bCoov5ABuPFFnDsAFO7leEZ0PGFHqjaO6iauJj+S5nmO0MhTFFy4COKKZpgPQHElzlBvT5UA/4nLhndR5lLJuw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-consts/MAL-2026-12908.json"