MAL-2026-12995

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-info-slider/MAL-2026-12995.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12995
Published
2026-08-05T14:38:15Z
Modified
2026-08-05T15:51:34.194507898Z
Summary
Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (36d339646cbe6f6c012c79bcb2c040941c777f5b76d67677bab4e11a3c46785d)

index.js unconditionally requires./setup.js when the module is loaded. setup.js selects a platform-specific payload for linuxx64, linuxarm64, darwin, or win32 and downloads it from Cloudflare Workers hostnames reconstructed at runtime via string-array joins (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS-TXT fallback on subdomains of dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Additional obfuscation is present: dynamic property assembly (fs["chmod"+"Sync"], require("child"+"process")), a cover-story marker file named.analytics_state, and a sibling lib/telemetry.js that presents Sentry-like SDK comments while duplicating the dropper primitives. The package's declared purpose ("platform adapter") does not exist as functionality — index.js exports a trivial no-op class, package.json declares no dependencies, and the only substantive behavior is the dropper. Any consumer that require()s this package receives full-host code execution from attacker-controlled infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "36d339646cbe6f6c012c79bcb2c040941c777f5b76d67677bab4e11a3c46785d",
            "id": "IN-MAL-2026-015380",
            "modified_time": "2026-08-05T14:38:15Z",
            "import_time": "2026-08-05T15:19:48.233522254Z",
            "source": "amazon-inspector",
            "versions": [
                "35.8.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-mobile-bnpl-info-slider

Package

Name
bnpl-blocks-mobile-bnpl-info-slider
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-mobile-bnpl-info-slider

Affected ranges

Affected versions

35.*
35.8.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "9665a57c46dc3ff8aec497dddaef35eac75ec1ff168eaf3efaf9183b31b5fcbe",
            "path": "setup.js",
            "tlsh": "a9a17796166670198bb0dbf4c7179815f65af6633380c288fb9c68985f7352483b1efc"
        },
        {
            "sha256": "64698dcff3f65f0dab41f24add5acbc8ff3dfb0c93772d3791c2cd3c8dbde0f8",
            "path": "package.json",
            "tlsh": "59c02252c830b63310b025853ca288427b620f5e3024cd4bb2b3202c40e20a1049d722"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-uNchpd0X2+tmAOKBBDWR4WhwPsczPpJ2Et0xXIXEJGzOKBG4dXLpg44RzFChFOknR8X+qzN2Fx9YcDdy7PoB7g==",
                "sha1": "b219417709dc413e100e04a0c6d78bddf95814d7"
            },
            "filename": "bnpl-blocks-mobile-bnpl-info-slider-35.8.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-info-slider/MAL-2026-12995.json"