MAL-2026-12990

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-grid-container/MAL-2026-12990.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12990
Published
2026-08-05T14:38:47Z
Modified
2026-08-05T15:51:31.275208463Z
Summary
Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70)

On require of the package, index.js loads _runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments (resolving to oob-worker.cf10{0,1,2,3}-*.workers.dev, with DNS TXT-record fallback to *.dl.wel1.ru), downloads a platform-specific binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under disguised filenames (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A second equivalent download-and-execute chain is bundled as lib/telemetry.js (base64 decode → chmodSync 0755 → cp.spawn('/bin/sh', ['-c', filePath + ' &'])), framed with SDK-style cover text and using split-string require("child_"+"process") to evade static analysis. The package's declared purpose is a native bridge, but _runtime.js performs no bridging logic — only the dropper flow.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70",
            "id": "IN-MAL-2026-015384",
            "modified_time": "2026-08-05T14:38:47Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T15:19:48.475402294Z",
            "versions": [
                "35.7.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-mobile-bnpl-grid-container

Package

Name
bnpl-blocks-mobile-bnpl-grid-container
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-mobile-bnpl-grid-container

Affected ranges

Affected versions

35.*
35.7.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "a2319967d24d0f7753a88ad75b05c3beeb24c66c60c4452a86eab621b8c122f8",
            "path": "_runtime.js",
            "tlsh": "dba1975a126a701d4bb097e4c71b8816f65af6a3378082d4f75c56884fb752883b1efc"
        },
        {
            "sha256": "16b5fdd424a1b7cba3ecd6a3b5227a12260cabfd9f7c411a56e3cc1a57e97e39",
            "path": "lib/telemetry.js",
            "tlsh": "79835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-6tp0RJ6UoHlYat86J2zkypPayKP3hzp9kEHT6NfJjHAXNt4b+3d2PESj/dtTfLjk+GTJsJDHF+bicWnC48//Xg==",
                "sha1": "35a98b50112a59163705ec961cb55ebd1ec0b932"
            },
            "filename": "bnpl-blocks-mobile-bnpl-grid-container-35.7.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-grid-container/MAL-2026-12990.json"