MAL-2026-12937

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-popup/MAL-2026-12937.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12937
Published
2026-08-05T14:46:57Z
Modified
2026-08-05T15:51:06Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-popup (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (be777645b47861c5f8e6bc2093eccac9543bfbc8c030e62bd69a54d4219ab52a)

The package's main entry loads init.js on require. init.js selects a platform-specific URL, assembles C2 hostnames at runtime via string-split/join to evade static analysis (e.g. 'oob-worker.cf99-9b3.workers.dev' family, with a DNS TXT covert-channel fallback over *.dl.wel1.ru where 'c.' returns a chunk count and 'i.' returns base64-encoded payload chunks), downloads an opaque executable, writes it to /tmp or the Windows temp directory under a decoy name such as dotnet_diag.exe or.cache, chmods it 0755, and spawns it detached through /bin/sh -c or cmd.exe. Behavior is gated only by a stamp file and opt-out environment variables. The package presents itself as UI popup components, which has no legitimate reason to fetch and run a platform-specific binary from anonymous Cloudflare Workers endpoints at import time.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-015439",
            "import_time":  "2026-08-05T15:19:51.426822877Z",
            "modified_time":  "2026-08-05T14:46:57Z",
            "sha256":  "be777645b47861c5f8e6bc2093eccac9543bfbc8c030e62bd69a54d4219ab52a",
            "source":  "amazon-inspector",
            "versions":  [
                "35.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-popup

Package

Name
bnpl-blocks-desktop-bnpl-popup
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-popup

Affected ranges

Affected versions

35.*
35.9.9

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "_init.js",
            "sha256":  "205acc52b93ff01cb58732bc29a0771f8090f50bc78626502cff90934be0b0a8",
            "tlsh":  "1ba1a75606a670088bb097f4872b4416f65ff6a33781c2d4f79ca9985f76428c272efc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "bnpl-blocks-desktop-bnpl-popup-35.9.9.tgz",
            "hashes":  {
                "sha1":  "33cc7ac75e3244d71da01e97381053d6eb316075",
                "sha512_sri":  "sha512-6QRTWBeKg3yPKqXA6omHrdppZUd7xIozNVGOwnhptKP0AvvAoLSOGZU5Ae/AlLtExZQASf7MLMwuek4dkimvFQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-popup/MAL-2026-12937.json"