MAL-2026-12957

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-info-slider/MAL-2026-12957.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12957
Published
2026-08-05T14:45:01Z
Modified
2026-08-05T15:51:16.049423202Z
Summary
Malicious code in bnpl-blocks-independent-bnpl-info-slider (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eabf8fd96af80f1588f7073731f3f670133e10f4c0e553c499081d3cb76b69ca)

The package advertises itself as a UI slider component but ships shim.js, which is loaded via index.js on require. On load, shim.js fetches a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT chunked fallback channel via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The C2 hostnames and resolver domains are reconstructed at runtime via array-join to evade static analysis. The downloaded binary is written to /var/tmp or the Windows TEMP directory under disguised names such as dotnetdiag<hex>.exe and.cache<hex>, chmod'd to 0755, and spawned detached with stdio ignored. Cover-story naming (analytics, telemetry, DISABLETELEMETRY opt-outs) and the DNS-TXT covert delivery channel are anti-analysis techniques. The behavior is unrelated to any legitimate purpose of a UI slider package and provides remote code execution on any host that installs or loads the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "eabf8fd96af80f1588f7073731f3f670133e10f4c0e553c499081d3cb76b69ca",
            "id": "IN-MAL-2026-015426",
            "modified_time": "2026-08-05T14:45:01Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:50.70716756Z",
            "versions": [
                "35.9.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-independent-bnpl-info-slider

Package

Name
bnpl-blocks-independent-bnpl-info-slider
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-independent-bnpl-info-slider

Affected ranges

Affected versions

35.*
35.9.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "92f70a1f0ed265b03ace36d38c36f718a0e3ccf51becb363686565c0566d24e3",
            "path": "_shim.js",
            "tlsh": "f0a1c79617a630198bb09be0c7174416f65fe6633380c294fb9ca5941fb312483b1efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-jMasj71+SYEPBJrZsGn6F23Pkh+WwX8rOewYragg9QRCavs/1idwF9f5AmUo9z7Y3R3d9vdgzA7LlEV199wt4w==",
                "sha1": "40d718ddb1f18c698a894c344605f6173f330143"
            },
            "filename": "bnpl-blocks-independent-bnpl-info-slider-35.9.8.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-info-slider/MAL-2026-12957.json"