MAL-2026-12973

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-tiles/MAL-2026-12973.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12973
Published
2026-08-05T14:42:32Z
Modified
2026-08-05T15:51:23.162246321Z
Summary
Malicious code in bnpl-blocks-independent-bnpl-tiles (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a)

On require() of this package, index.js loads adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split character arrays (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, cf103-070/cf99-9b3/cf102-baf.workers.dev and.ru fallbacks sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), fetches an opaque binary over HTTPS, writes it to a temp path under a cover-story name (dotnetdiag<hex>.exe /.cache<hex>), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT covert channel fetches a base64-chunked payload via numbered TXT records when HTTPS is blocked. The host strings are split into arrays and rejoined at runtime to defeat static inspection, and no hash or signature verification is performed on the fetched bytes. Import (require/load) of the module triggers the download-and-execute path unconditionally, giving remote code execution on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.8.9"
            ],
            "sha256": "56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a",
            "id": "IN-MAL-2026-015409",
            "import_time": "2026-08-05T15:19:49.853454075Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T14:42:32Z"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-independent-bnpl-tiles

Package

Name
bnpl-blocks-independent-bnpl-tiles
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-independent-bnpl-tiles

Affected ranges

Affected versions

35.*
35.8.9

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-independent-bnpl-tiles/MAL-2026-12973.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_adapter.js",
            "tlsh": "dba1979616a670184bb09be4c727481af55bf76333c0c298fb5ca5981f7212482b1dfc",
            "sha256": "84eff7e8bb316cc129cdc61d81c5b52b7d74ed7f60b412fb3ff15cf0365fd86a"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-independent-bnpl-tiles-35.8.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-hfB6kQOs61BO5ehs2SBaFGXUK+FregYsioSvhzDJGXH7pgkGsamS+kCAhAmo4nzR1yFH4AlVIA+lGnc1qEM9EA==",
                "sha1": "a9b3c2606c7590afe1e73f2abe45a8e4cca64ab2"
            }
        }
    ]
}