MAL-2026-12992

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-header-search/MAL-2026-12992.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12992
Published
2026-08-05T14:38:31Z
Modified
2026-08-05T15:51:31.523063281Z
Summary
Malicious code in bnpl-blocks-mobile-bnpl-header-search (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370)

On require of the package's main entry, _shim.js constructs Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf103-070, cf101-adf, cf99-9b3 subdomains) by joining string fragments, downloads an opaque binary over HTTPS, and falls back to a base64-over-DNS-TXT channel under *.dl.wel1.ru (reading c.<domain> TXT for a chunk count then <i>.<domain> TXT records) when HTTPS is unavailable. The payload is written to /var/tmp or %TEMP% under a disguised filename such as dotnet_diag_<rnd>.exe or .cache_<rnd>, chmod 0755 on Unix, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A marker file (/tmp/.analytics_state / %TEMP%\analytics_state) rate-limits re-execution to roughly once per 20787 seconds, and the loader silently no-ops when DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, or DO_NOT_TRACK are set — telemetry-flavored naming that does not match the fetch-and-execute-native-code behavior. Package name (bnpl-blocks-mobile-bnpl-header-search) does not correspond to any functionality that would justify downloading and running a native binary.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370",
            "id": "IN-MAL-2026-015382",
            "modified_time": "2026-08-05T14:38:31Z",
            "import_time": "2026-08-05T15:19:48.359115605Z",
            "source": "amazon-inspector",
            "versions": [
                "35.3.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-mobile-bnpl-header-search

Package

Name
bnpl-blocks-mobile-bnpl-header-search
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-mobile-bnpl-header-search

Affected ranges

Affected versions

35.*
35.3.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "a3cbc35edfe11e7e8790fe8d0f09a13b47c5d3c6cbb75cac143e917ea7abdae0",
            "path": "_shim.js",
            "tlsh": "5cb1869a06a970194bb0e7e4ca1b4415f59bf6633781c1d4fb5ca9885fb31248372efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Cfa6Cu5R0fNu+4n1E8nsmlGxtWuvTZo+yTQp7qHTEvLRWKTY+zPkBAhv6Q31PY4Z+Nw6g3rIpPP2xAhw+QZHGA==",
                "sha1": "356919c05eae740066458ae5860b5aa9141369d5"
            },
            "filename": "bnpl-blocks-mobile-bnpl-header-search-35.3.7.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-header-search/MAL-2026-12992.json"