MAL-2026-12949

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-anchor/MAL-2026-12949.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12949
Published
2026-08-05T14:45:42Z
Modified
2026-08-05T15:51:12.190197085Z
Summary
Malicious code in bnpl-blocks-independent-bnpl-anchor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (79e1b9234ec9e2447ea3f3a53a8e4a16e4323d7f1138c2f0bedb4bc25fa43a1e)

On require('bnpl-blocks-independent-bnpl-anchor'), index.js loads helpers.js which selects a per-platform payload, downloads an opaque binary from one of several Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS-TXT fallback to sdk.dl.wel1.ru, writes the payload to /tmp/.cache<hex> on Unix or %TEMP%\dotnetdiag<hex>.exe on Windows, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are assembled from split string arrays (e.g. ['oob-worker.cf99','-9b3.workers.d','ev'].join('')) to evade static analysis. A hidden idempotency marker (/tmp/.analyticsstate or %TEMP%\analyticsstate) and env-var opt-outs (DISABLETELEMETRY, ANALYTICSOPTOUT, DONOTTRACK) plus filenames like dotnetdiag_<uid>.exe give the loader a telemetry/diagnostics cover story. The fetched destinations are anonymous workers.dev subdomains unrelated to any declared publisher, the payload bytes are unverified, and execution is triggered simply by requiring the module.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "79e1b9234ec9e2447ea3f3a53a8e4a16e4323d7f1138c2f0bedb4bc25fa43a1e",
            "id": "IN-MAL-2026-015431",
            "modified_time": "2026-08-05T14:45:42Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:51.029651736Z",
            "versions": [
                "35.6.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-independent-bnpl-anchor

Package

Name
bnpl-blocks-independent-bnpl-anchor
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-independent-bnpl-anchor

Affected ranges

Affected versions

35.*
35.6.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "1677d3b3cd561de489daf36862030e80398221bd6f81fbd782de3b986a5de4c0",
            "path": "_helpers.js",
            "tlsh": "91a1a7a716aa70188bb09be4c727541af557f6633380c684fb5ca5981f7612482b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-iG3VcxTtdbdpyhk/AWdFPvn+NfeUqyc3ITvVyp1Tnye0HE3O7vWm5/rFAzM0Z1aWS987s9HWKz6Oue2YVKrp5A==",
                "sha1": "19d0aac75840059bca815edbf551e53198a47ba8"
            },
            "filename": "bnpl-blocks-independent-bnpl-anchor-35.6.5.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-anchor/MAL-2026-12949.json"