MAL-2026-12970

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-swagger/MAL-2026-12970.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12970
Published
2026-08-05T14:43:24Z
Modified
2026-08-05T15:51:21Z
Summary
Malicious code in bnpl-blocks-independent-bnpl-swagger (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c350c1b92915eddb1ffa1c2568e75ead40ada15365f38428b7f4e5177ab5937a)

On require('bnpl-blocks-independent-bnpl-swagger'), index.js loads platform.js, which reassembles Cloudflare Workers hostnames via array-join string-split obfuscation (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070) with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, selects a platform-specific URL, downloads a binary via https.get, writes it to a temp path with a decoy name (dotnet_diag.exe on Windows,.cache_ on Unix), chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Execution is gated to skip when DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK are set, with state cached in /tmp/.analytics_state to evade sandboxes that pre-set opt-out flags. The package advertises itself as a BNPL swagger integration library but the exported class is a no-op stub; the sole runtime effect is the dropper. Advertised purpose does not match shipped code, hostnames are obfuscated to defeat static scanners, decoy filenames masquerade as system diagnostics, and the destination hosts are attacker-controlled rather than the publisher's infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015415",
            "import_time": "2026-08-05T15:19:50.16395265Z",
            "modified_time": "2026-08-05T14:43:24Z",
            "sha256": "c350c1b92915eddb1ffa1c2568e75ead40ada15365f38428b7f4e5177ab5937a",
            "source": "amazon-inspector",
            "versions": [
                "35.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-independent-bnpl-swagger

Package

Name
bnpl-blocks-independent-bnpl-swagger
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-independent-bnpl-swagger

Affected ranges

Affected versions

35.*
35.5.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_platform.js",
            "sha256": "652b86c58e04c77208be5d7f8f76b03fb9baa140a9f41fe6c00a38307ec17a69",
            "tlsh": "cfb1a69a156670194bb0dbe487175415f65af6633381c188fb6ca8981fb3124c3b2efc"
        },
        {
            "path": "index.js",
            "sha256": "10205b2f3940f6d39c57efa9daf5d9a4b53075bd569de8d2e89885a2287058d3",
            "tlsh": "67f02d8916eef42387f4f3e7de610052f561d5700a47859c768440ee1e68c5002acebb"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-independent-bnpl-swagger-35.5.1.tgz",
            "hashes": {
                "sha1": "de91379109c89efb63d9c645dfbb86c6bdb48c4b",
                "sha512_sri": "sha512-j34Pq9XM5TfKaXElYeUXGz9qje82ZsOmeCfjhAO25Cbqs3mFNORSQD/Tyby61PPmE5WanojkG5ixNihg6OtJUg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-swagger/MAL-2026-12970.json"