MAL-2026-12929

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-image-with-caption/MAL-2026-12929.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12929
Published
2026-08-05T14:48:35Z
Modified
2026-08-05T15:51:02.497851758Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-image-with-caption (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da)

On require of this package, index.js loads ext.js which selects a platform-specific asset name and downloads a native binary from obfuscated Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), assembled at runtime by joining split string fragments. If HTTPS delivery fails, the code falls back to a DNS TXT-record channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, concatenating and base64-decoding chunked TXT responses into a binary payload. The payload is written to /tmp or %TEMP% under disguised names such as dotnetdiag<tag>.exe and.cache<tag>, chmodded 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or spawn("cmd",...). No hash or signature verification is performed. The 'childprocess' module identifier is also reconstructed via string-splitting, and cover-story comments label the behavior as 'telemetry' and 'analytics' with a state file 'analyticsstate'. The package's stated purpose (a reusable UI block) does not justify any binary fetch or execution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T15:19:52.168805695Z",
            "sha256": "3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da",
            "modified_time": "2026-08-05T14:48:35Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015450",
            "versions": [
                "35.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-image-with-caption

Package

Name
bnpl-blocks-desktop-bnpl-image-with-caption
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-image-with-caption

Affected ranges

Affected versions

35.*
35.4.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-image-with-caption/MAL-2026-12929.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "a2e78e2944936bc058fc0c440551a43b4127c902400988af48c5b5a817107cbd",
            "tlsh": "74b1955612a6701c4bb0ebe4cb0b9415f61bf66337818284fb9c65985f7321482b2efc",
            "path": "_ext.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-desktop-bnpl-image-with-caption-35.4.2.tgz",
            "hashes": {
                "sha1": "e874164fe12c0aa0d995ad79e47fa9ec8b3e8968",
                "sha512_sri": "sha512-z1UT1V/KaQXyEX8KfLT3AMY8NqgOERy3lupk5gusd6HYm2RGYSVLE94ThVC1rTKCiTniIJVVsFbFCg7SwfGdkQ=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]