MAL-2026-12915

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-button-set/MAL-2026-12915.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12915
Published
2026-08-05T14:51:32Z
Modified
2026-08-05T15:50:56.198179921Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-button-set (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e7581057c70b3b5e805e0d56c30e74c4fc88c8c23aa0ceb73a46a2b17b937bb0)

On require of the package, index.js loads polyfill.js which selects a platform-specific asset, fetches a binary from string-fragmented Cloudflare Workers hostnames (e.g. oob-worker.cf102-baf.workers.dev, assembled at runtime via array.join('') to evade static scanners) with a DNS-TXT base64 reassembly fallback via *.dl.wel1.ru, writes the payload to /tmp or %TEMP% under disguised names such as '.cache<rand>' or 'dotnetdiag<rand>.exe', chmods it 0755, and spawns it detached via /bin/sh -c '<path> &' (or cmd on Windows). A filesystem stamp at /tmp/.analyticsstate throttles re-runs. The destinations are not first-party, not pinned, and the fetched bytes are unverified. A parallel, currently-unreferenced dropper module lib/telemetry.js ships the same scaffolding (childprocess spawn of /bin/sh, base64 chunk assembly, chmod 0755) bundled in the tarball. The package advertises a UI (BNPL button set) adapter, which is inconsistent with fetching and executing remote native binaries on require.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015470",
            "import_time": "2026-08-05T15:19:53.178116546Z",
            "sha256": "e7581057c70b3b5e805e0d56c30e74c4fc88c8c23aa0ceb73a46a2b17b937bb0",
            "versions": [
                "35.3.7"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:51:32Z"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-button-set

Package

Name
bnpl-blocks-desktop-bnpl-button-set
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-button-set

Affected ranges

Affected versions

35.*
35.3.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_polyfill.js",
            "tlsh": "f7a1975a06b630198bb0dbe4cb174816f65ae6633780c684fb9ca9945f73524c3b2dfc",
            "sha256": "629066f957b2cbba7c74b4336192154b73888bb3922ddb0ccab73182be2a5274"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "c9835055566a242186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc",
            "sha256": "0bc17a1413a411eac451211ae760f47af43a6894ec5447ac11c788492582b212"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-desktop-bnpl-button-set-35.3.7.tgz",
            "hashes": {
                "sha1": "f2fa1cc027aa14b10a730b3be39d2d8f6a9c153a",
                "sha512_sri": "sha512-wECpWVQ3KUyCUIsl8jSZebzT0DszlXQkLgAurFRMMB+PU1Lr0sVs6glt7nL9dG6T4NZ6z93IqRBAtjVGUHu67A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-button-set/MAL-2026-12915.json"