MAL-2026-12955

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-faq/MAL-2026-12955.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12955
Published
2026-08-05T14:45:26Z
Modified
2026-08-05T15:51:15.690051512Z
Summary
Malicious code in bnpl-blocks-independent-bnpl-faq (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (62fa2b8c94722055f1345a068fc74b842d0fe8120702208c73f2defd93744194)

On require() of this package, index.js loads runtime.js which downloads a platform-specific binary over HTTPS from obfuscated hosts (oob-worker.cf<n>-<n>.workers.dev, assembled by joining fragmented string arrays to evade static scans), writes it to a disguised path in /tmp or %TEMP% (e.g..cache<hex> or dotnetdiag<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS fails, _runtime.js falls back to reassembling a base64-encoded binary from DNS TXT records under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru subdomains and executes it via the same path. No hash or signature verification is performed, and destination hostnames are hidden via array-join obfuscation. The package advertises itself as a BNPL FAQ adapter; the declared purpose does not require binary downloads or a DNS covert channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "62fa2b8c94722055f1345a068fc74b842d0fe8120702208c73f2defd93744194",
            "id": "IN-MAL-2026-015429",
            "modified_time": "2026-08-05T14:45:26Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:50.925552417Z",
            "versions": [
                "35.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-independent-bnpl-faq

Package

Name
bnpl-blocks-independent-bnpl-faq
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-independent-bnpl-faq

Affected ranges

Affected versions

35.*
35.1.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "2280aae45ad8945d9c6bc290c05b3bad545a00308241e384c0dfadc55be4c674",
            "path": "_runtime.js",
            "tlsh": "1ca1b696126a300847b097e4c71b9416f65bf7633780c685fb6ca5981fb712883b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-U4qopSYozwWwq0wfzNvpA55gl2r3RqtYMtjCkKSLMBw59JEW5RRrYp/pFcoD7uI5YrrdMJ6YlzL4qwGhIAQaqg==",
                "sha1": "3235234ea5394a985925f637758bd69ce2dde126"
            },
            "filename": "bnpl-blocks-independent-bnpl-faq-35.1.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-faq/MAL-2026-12955.json"