MAL-2026-12970

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-swagger/MAL-2026-12970.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12970
Published
2026-08-05T14:43:24Z
Modified
2026-08-05T15:51:21.934755337Z
Summary
Malicious code in bnpl-blocks-independent-bnpl-swagger (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c350c1b92915eddb1ffa1c2568e75ead40ada15365f38428b7f4e5177ab5937a)

On require('bnpl-blocks-independent-bnpl-swagger'), index.js loads platform.js, which reassembles Cloudflare Workers hostnames via array-join string-split obfuscation (oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070) with a DNS-TXT covert-channel fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, selects a platform-specific URL, downloads a binary via https.get, writes it to a temp path with a decoy name (dotnetdiag<hex>.exe on Windows,.cache<hex> on Unix), chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Execution is gated to skip when DISABLETELEMETRY, ANALYTICSOPTOUT, or DONOTTRACK are set, with state cached in /tmp/.analyticsstate to evade sandboxes that pre-set opt-out flags. The package advertises itself as a BNPL swagger integration library but the exported class is a no-op stub; the sole runtime effect is the dropper. Advertised purpose does not match shipped code, hostnames are obfuscated to defeat static scanners, decoy filenames masquerade as system diagnostics, and the destination hosts are attacker-controlled rather than the publisher's infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "c350c1b92915eddb1ffa1c2568e75ead40ada15365f38428b7f4e5177ab5937a",
            "id": "IN-MAL-2026-015415",
            "modified_time": "2026-08-05T14:43:24Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:50.16395265Z",
            "versions": [
                "35.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-independent-bnpl-swagger

Package

Name
bnpl-blocks-independent-bnpl-swagger
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-independent-bnpl-swagger

Affected ranges

Affected versions

35.*
35.5.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "652b86c58e04c77208be5d7f8f76b03fb9baa140a9f41fe6c00a38307ec17a69",
            "path": "_platform.js",
            "tlsh": "cfb1a69a156670194bb0dbe487175415f65af6633381c188fb6ca8981fb3124c3b2efc"
        },
        {
            "sha256": "10205b2f3940f6d39c57efa9daf5d9a4b53075bd569de8d2e89885a2287058d3",
            "path": "index.js",
            "tlsh": "67f02d8916eef42387f4f3e7de610052f561d5700a47859c768440ee1e68c5002acebb"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-j34Pq9XM5TfKaXElYeUXGz9qje82ZsOmeCfjhAO25Cbqs3mFNORSQD/Tyby61PPmE5WanojkG5ixNihg6OtJUg==",
                "sha1": "de91379109c89efb63d9c645dfbb86c6bdb48c4b"
            },
            "filename": "bnpl-blocks-independent-bnpl-swagger-35.5.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-swagger/MAL-2026-12970.json"