MAL-2026-12971

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-table/MAL-2026-12971.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12971
Published
2026-08-05T14:43:08Z
Modified
2026-08-05T15:51:22.045915838Z
Summary
Malicious code in bnpl-blocks-independent-bnpl-table (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf)

Requiring bnpl-blocks-independent-bnpl-table transitively loads compat.js, which auto-invokes a start() routine at module load. The routine downloads a platform-specific native executable over HTTPS from Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru for base64-encoded payload delivery. Hostnames are reconstructed at runtime by joining split string fragments to hide them from casual inspection. The downloaded binary is written to /tmp (Unix) as a hidden file named.cache<hex> or to %TEMP% (Windows) under a masquerading name like dotnetdiag<hex>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd.exe. A stamp file named.analytics_state and 'telemetry'/'graceful degradation' labels form a cover story. The delivered binary is opaque, unpinned, unverified, and the fetch destinations do not match the package publisher and are unrelated to the package's stated BNPL-table purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf",
            "id": "IN-MAL-2026-015413",
            "modified_time": "2026-08-05T14:43:08Z",
            "import_time": "2026-08-05T15:19:50.053625146Z",
            "source": "amazon-inspector",
            "versions": [
                "35.3.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-independent-bnpl-table

Package

Name
bnpl-blocks-independent-bnpl-table
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-independent-bnpl-table

Affected ranges

Affected versions

35.*
35.3.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ddd78ad09dff2c3321388df9ab269b31a421b83b3cf3a7ebdadf94deb9d6d9aa",
            "path": "_compat.js",
            "tlsh": "68b1a796166670198bb0dbf1c7175415f65af6a33780c288fb8c98980f7316483b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-em5YXFHiFwPp/WXo6JgZ4diRWMvLgOvwibED0SWVZoGJKKhUvLVcPm4Pkp1oaBS4DII9fmRf9K4pgOJ7nSh1qg==",
                "sha1": "86260352d9a5097b6fc03faf091220c28ea288a1"
            },
            "filename": "bnpl-blocks-independent-bnpl-table-35.3.7.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-table/MAL-2026-12971.json"