MAL-2026-12909

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-data-schema-generator/MAL-2026-12909.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12909
Published
2026-08-05T14:51:23Z
Modified
2026-08-05T15:50:53Z
Summary
Malicious code in bnpl-blocks-data-schema-generator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b1e39c2d94a6114333c4275444d786188f00056a96e6e6296cd3abf275e3d5bc)

index.js unconditionally requires bootstrap.js, which on module load reconstructs Cloudflare Workers subdomains (oob-worker.cf10x-xxx.workers.dev) and *.dl.wel1.ru hosts from split string fragments, fetches a platform-specific executable via https.get with a DNS-TXT fallback that reassembles base64 chunks from numbered subdomains, writes the payload to a temp path under disguised names (e.g. dotnet_diag.exe,.cache_), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start. A second file lib/telemetry.js labelled as a telemetry SDK contains the same write+chmod+spawn primitives (Buffer.from(chunks,'base64'), cp.spawn('/bin/sh',['-c', filePath+' &']), fs['chmod'+'Sync'](extensionPath, 0755)) as a redundant dropper. The behavior fires whenever any consumer require()s the package, giving arbitrary remote code execution on the installer's host.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-015469",
            "import_time":  "2026-08-05T15:19:53.124985795Z",
            "modified_time":  "2026-08-05T14:51:23Z",
            "sha256":  "b1e39c2d94a6114333c4275444d786188f00056a96e6e6296cd3abf275e3d5bc",
            "source":  "amazon-inspector",
            "versions":  [
                "35.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-data-schema-generator

Package

Name
bnpl-blocks-data-schema-generator
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-data-schema-generator

Affected ranges

Affected versions

35.*
35.2.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "_bootstrap.js",
            "sha256":  "d0fd1f509dd1c86975d12ed0a7fae9dc708927be2dc5c3cfc15e1c7ad7f421be",
            "tlsh":  "15b1979a12a671084bb0e7e4c7178815f66bf663368182d8f7ac65844f73124c3b2efc"
        },
        {
            "path":  "lib/telemetry.js",
            "sha256":  "ea4233422f41d791456b450335d404a15ea2f67195da50fa8549f85912baf996",
            "tlsh":  "23835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "bnpl-blocks-data-schema-generator-35.2.1.tgz",
            "hashes":  {
                "sha1":  "312447a1d4d5c3da8fcfd24f3e8313ba1755065e",
                "sha512_sri":  "sha512-T5wFdVYXRnb91Jz0NBROYrbQnDbPU1fnvlNLGV+eYutEJkXlpq/xd1lVUYdrh412E5nqiNbk8a/Ua/3ANPsoeQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-data-schema-generator/MAL-2026-12909.json"