MAL-2026-12935

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-partners/MAL-2026-12935.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12935
Published
2026-08-05T14:47:04Z
Modified
2026-08-05T15:51:05.321649130Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-partners (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8)

On require() of this package, runtime.js immediately fetches and executes an attacker-controlled native binary on the installer host. Destination hostnames are reconstructed at runtime by joining split string fragments to evade static analysis, resolving to Cloudflare Workers hosts under oob-worker.cf10{0-3}-*.workers.dev and.ru subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. A platform-specific endpoint is selected, the payload is written to /tmp or %TEMP% under disguised names such as.cache<hex> or dotnetdiag<hex>.exe, chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS fetch fails, the module falls back to a DNS-TXT covert channel that base64-reassembles executable bytes from TXT records under the same.ru subdomains, bypassing HTTP egress controls. The destinations are unrelated to any declared publisher, unpinned, and unverified.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015440",
            "import_time": "2026-08-05T15:19:51.452877727Z",
            "sha256": "63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8",
            "versions": [
                "35.9.5"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:47:04Z"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-partners

Package

Name
bnpl-blocks-desktop-bnpl-partners
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-partners

Affected ranges

Affected versions

35.*
35.9.5

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_runtime.js",
            "tlsh": "9ba1759a1666700987b0d7e4c71b5416f69af66333c081d8f79c65881fb316443b1efc",
            "sha256": "126ece51df675492f6a25b2c543cc84ff6763c575974eb2adcc6dc910121d390"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-desktop-bnpl-partners-35.9.5.tgz",
            "hashes": {
                "sha1": "89672b4a77ef6ad9ab0a49452cb2c8dd38ddca08",
                "sha512_sri": "sha512-JeRh0MZ0Y2hI/gQh/DKz4/HGwdvvPoMhoAWq9kLqDwIAC+Ij7ngXEgV/62c/loyI0IgfluOzU9CtvRwbqHdWTA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-partners/MAL-2026-12935.json"