MAL-2026-12947

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-feature-partners/MAL-2026-12947.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12947
Published
2026-08-05T14:46:18Z
Modified
2026-08-05T15:51:11.494112413Z
Summary
Malicious code in bnpl-blocks-feature-partners (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (40f5d479d4fbf50975912fcbb27c8a3638cfeef78c8bd8a2e666162756abc788)

index.js unconditionally require()'s./ext.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers hosts (oob-worker.cf10{1,2,3}-*.workers.dev) reassembled from split string literals, with a DNS-TXT chunked base64 fallback via *.dl.wel1.ru subdomains, writes the payload to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Network destinations and sensitive API names (childprocess, chmodSync) are reconstructed at runtime from split-string arrays to evade static scanners. No integrity check, no hash/signature verification, filename disguises (.cache / dotnetdiag) mimic system caches, and the fetched code is unrelated to any stated package purpose. The dropper fires on any require() of this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "40f5d479d4fbf50975912fcbb27c8a3638cfeef78c8bd8a2e666162756abc788",
            "id": "IN-MAL-2026-015435",
            "modified_time": "2026-08-05T14:46:18Z",
            "import_time": "2026-08-05T15:19:51.243519628Z",
            "source": "amazon-inspector",
            "versions": [
                "35.9.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-feature-partners

Package

Name
bnpl-blocks-feature-partners
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-feature-partners

Affected ranges

Affected versions

35.*
35.9.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "5614efb0467b089f2ac66ef2ffc06c5e241a1fa1b073e3234864d745bfaed131",
            "path": "_ext.js",
            "tlsh": "f2a1a8aa066630084bb0d7e5c617541af65bf6633780d2d4fb5c65981fb252483f2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-m7qvZAqYxQwCBuaaY61NDhMKqsDqVRp7eFWM5S1QnqqZFc2DJlEPf59STJuFZexVJ7E0xeGtkUo/v0aqJNc+VA==",
                "sha1": "ebdbee1f5a8395e0decce72daf62929759edf129"
            },
            "filename": "bnpl-blocks-feature-partners-35.9.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-feature-partners/MAL-2026-12947.json"