MAL-2026-12943

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-table/MAL-2026-12943.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12943
Published
2026-08-05T14:48:17Z
Modified
2026-08-05T15:51:09.326470478Z
Summary
Malicious code in bnpl-blocks-desktop-bnpl-table (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (53a00a782a1b951d114dd07c4e2e5bf08226730274beb0b88842034b5c71e9dd)

On require of the package, index.js unconditionally loads adapter.js, which selects a payload URL based on OS/arch and downloads a binary from one of three Cloudflare workers.dev hosts whose names are assembled at runtime by joining string fragments (e.g., ["oob-work","er.cf99-9b3",".w","or","kers",".dev"].join("")), with a DNS-TXT covert-channel fallback resolving through *.dl.wel1.ru. The downloaded bytes are written to a temp path under a deceptive name (dotnetdiag<rand>.exe on Windows,.cache<rand> on Unix), chmod 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. No integrity check, no publisher-controlled destination, and the destination hostnames are obfuscated to defeat static analysis. Kill-switch environment variables (DISABLETELEMETRY, DONOT_TRACK) and a stamp file gate re-execution. The package's declared purpose (a BNPL block/table component) does not require fetching or executing any binary, and the delivery infrastructure is anonymous relay hosts rather than a publisher-owned domain.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "53a00a782a1b951d114dd07c4e2e5bf08226730274beb0b88842034b5c71e9dd",
            "id": "IN-MAL-2026-015448",
            "modified_time": "2026-08-05T14:48:17Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:52.04576073Z",
            "versions": [
                "35.4.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-desktop-bnpl-table

Package

Name
bnpl-blocks-desktop-bnpl-table
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-desktop-bnpl-table

Affected ranges

Affected versions

35.*
35.4.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "c1aa1c45576b9a24eedf91a9db39a62b5e5b6107f4122304db01f2f21064e54f",
            "path": "_adapter.js",
            "tlsh": "f8a1875a05a6b0184bb0dbe0c61b8816f65bf6633781c188f79c69989f735248372dfc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-VgWqAqOcPjMCrjXv5aJF7MN+O3fRtbnVgTI8BnyNVaTkt0rGJKIXABckeYJYs1zRK7zFdVjrtvNkzP8sxeOrIA==",
                "sha1": "63c0f8611d8c6d89e982dd814ac53136b5d09668"
            },
            "filename": "bnpl-blocks-desktop-bnpl-table-35.4.7.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-table/MAL-2026-12943.json"