MAL-2026-12931

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-link-group/MAL-2026-12931.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12931
Published
2026-08-05T14:49:10Z
Modified
2026-08-05T15:51:03.486069397Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-link-group (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3419412ce27e6f0442a6e828cf62c4f8851be28a969e977a799559e038c75ea7)

On require of the package's main entry, index.js loads./vendor, which reconstructs Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev) via runtime string concatenation, downloads platform-specific binary bytes, writes them to a disguised temp filename (.cache<hex> or dotnetdiag<hex>.exe), chmods the file to 0755, and spawns it detached via /bin/sh -c '<path> &' on Unix or cmd.exe /c start /b on Windows. A DNS-based fallback discovery mechanism reassembles the domains sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru from split fragments. No hash or signature verification is performed on the downloaded payload, and the destinations are unrelated to any legitimate publisher of this package. A second copy of the dropper primitives (base64 chunk assembly, chmodSync to 0755, detached /bin/sh spawn, string-split require("child_"+"process")) is bundled in lib/telemetry.js. Cover-story comments frame the behavior as analytics/telemetry and cache validation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015454",
            "import_time": "2026-08-05T15:19:52.362649055Z",
            "sha256": "3419412ce27e6f0442a6e828cf62c4f8851be28a969e977a799559e038c75ea7",
            "versions": [
                "35.4.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:49:10Z"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-link-group

Package

Name
bnpl-blocks-desktop-bnpl-link-group
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-link-group

Affected ranges

Affected versions

35.*
35.4.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_vendor.js",
            "tlsh": "0aa1b55a06a670198bb097f4c71b4416f65be6a33780c1d4fbac59985fb2224c3b2dfc",
            "sha256": "8c9b814d6e1b9becea48b873fc591b5b1d06feb4ea0c0ecbdbb9a43a5e75d88f"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "3d835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "29f4dd60ef19b5e3dd6d822ab0228ac4d96d7d658b95e385a56d9152ad2ee76e"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-desktop-bnpl-link-group-35.4.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-zOCBxsrwbU5ri05tz38jlS1RF4l51mcCybHEXWLVxHZa0iyNNza+FB1UuIHZywYq7yRRmkDTXaGZWMWE+nxcSw==",
                "sha1": "41d228ac582123a4347d8e26b7ca436291e8543e"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-link-group/MAL-2026-12931.json"