MAL-2026-12921

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-feedback/MAL-2026-12921.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12921
Published
2026-08-05T14:49:38Z
Modified
2026-08-05T15:50:58.797677296Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-feedback (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7a55a8b87f5fcabb03e7b44b8f85aafe3a6b8a6a1f8799305b21544055e99845)

index.js require()s./init on load. init.js downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts (oob-worker.cf101-.workers.dev, oob-worker.cf102-.workers.dev, oob-worker.cf103-*.workers.dev) via https.get, writes it to /var/tmp or %TEMP% under a disguised name (dotnetdiag<rand>.exe on Windows,.cache_<rand> on Linux/macOS), chmods it 0755, and spawns it detached via cp.spawn('/bin/sh',['-c', fp+' &']) or spawn('cmd',...). A DNS-TXT covert-channel fallback resolves chunked base64 payloads from *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) via dns.resolveTxt, reassembles them, writes and executes the reconstructed buffer. Destination hostnames are assembled at runtime via Array.join from split fragments to evade static analysis, no version pin, no hash or signature verification, and a TTL marker suppresses re-execution. Full remote code execution on the installer's host fires at module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015457",
            "import_time": "2026-08-05T15:19:52.517030286Z",
            "sha256": "7a55a8b87f5fcabb03e7b44b8f85aafe3a6b8a6a1f8799305b21544055e99845",
            "modified_time": "2026-08-05T14:49:38Z",
            "source": "amazon-inspector",
            "versions": [
                "35.3.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-feedback

Package

Name
bnpl-blocks-desktop-bnpl-feedback
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-feedback

Affected ranges

Affected versions

35.*
35.3.6

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-feedback/MAL-2026-12921.json"
indicators 
{
    "evidence_files": [
        {
            "path": "_init.js",
            "tlsh": "68a1a69a06a630198bb0d7e487174816f65af6a33380c5c4fb5c69980f77128c3b2efc",
            "sha256": "1e1f4417832a23b05659cba4f4920bf5bdceee396ad2e02231a25685dcb10fa5"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-desktop-bnpl-feedback-35.3.6.tgz",
            "hashes": {
                "sha512_sri": "sha512-eJt0l88ZLl6z4syCTQvFDh0Bm9DZKx0/BX54qghLyvxdu4TYI+rm+zEj/JEBO6O1hssJ7sGUSSbipVxVr8uzww==",
                "sha1": "10919f3538c0e42c8472bfe3d69392607ef55042"
            }
        }
    ]
}