MAL-2026-12942

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-tab-buttons/MAL-2026-12942.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12942
Published
2026-08-05T14:46:08Z
Modified
2026-08-05T15:51:09.037590054Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-tab-buttons (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (10f3c6bfbfc78abe18386c92d3ab2a2fde60f132517944f3d3f015bf3ba660bf)

On require of this package, index.js loads platform.js, which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT-record fallback channel over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /tmp or %TEMP% under disguised names (dotnetdiag_*.exe,.cache_*, loadermac, package.exe, package, package-arm64), chmodded 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Endpoint hostnames and dangerous APIs are assembled at runtime from split string fragments (e.g. ["oob-worker.cf99-9b3.worke","rs.de","v"].join(""), require("child"+"process"), fs["chmod"+"Sync"]) to evade string scanners. A per-host dedup stamp (.analytics_state) is written to avoid re-triggering. A second, redundant dropper implementation is bundled in lib/telemetry.js, which assembles a base64 payload from DNS TXT records, writes it to disk, chmods it 0755, and detached-spawns /bin/sh. No pinning, hashing, or signature verification is performed on the fetched executables. The package name and 'Analytics SDK' framing in comments do not match the observed behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "10f3c6bfbfc78abe18386c92d3ab2a2fde60f132517944f3d3f015bf3ba660bf",
            "id": "IN-MAL-2026-015434",
            "modified_time": "2026-08-05T14:46:08Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:51.189234649Z",
            "versions": [
                "35.9.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-tab-buttons

Package

Name
bnpl-blocks-desktop-bnpl-tab-buttons
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-tab-buttons

Affected ranges

Affected versions

35.*
35.9.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "b2cb7b68260aa601910a54de32f5f6a71b15086355937c6b1c5dc38a340d527f",
            "path": "_platform.js",
            "tlsh": "3da1a79a02a670184bb0dbe4ca275419f61bf6633780c6c4fb5ca5d41fb212483b2efc"
        },
        {
            "sha256": "42e2495c04cbc20b56e3fbb9480015bf7b10b9b2f70170160ebdfdab32053202",
            "path": "lib/telemetry.js",
            "tlsh": "c3835056566a142186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-jddvzeNVDnhwOpIknksZe1AKJCDsQEkGJaxEZW1/LPnvIXaLWOJgq2Q/M4+9IYA5toz/8nRIuzZAHarkFMHtqA==",
                "sha1": "6d543c6eb4b90df327a2ee03b1a2f73b79a5d6c6"
            },
            "filename": "bnpl-blocks-desktop-bnpl-tab-buttons-35.9.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-tab-buttons/MAL-2026-12942.json"