MAL-2026-13006

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-shopping-header/MAL-2026-13006.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13006
Published
2026-08-05T14:36:31Z
Modified
2026-08-05T15:51:38.755156118Z
Summary
Malicious code in bnpl-blocks-mobile-bnpl-shopping-header (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3bc4c244c6348b8ac4006067e983f7a3a58a7d00c5356d10d8d452c02823d1e1)

On require() of the package, index.js loads init.js which selects a platform-specific endpoint, downloads an opaque binary from rotating Cloudflare Workers mirror hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback via *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under a disguised name (dotnetdiag_*.exe,.cache_*), chmods 755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed and the fetched binary has no relation to the package's stated purpose. Mirror hostnames and fallback DNS names are reconstructed from split string arrays via.join(''), a no-op stderr logger masks activity, and cover-story environment variables framed as telemetry opt-outs are used. lib/telemetry.js (81KB) contains a parallel dropper implementation with the same fetch → write → chmod 755 → spawn '/bin/sh -c filePath &' pattern, base64 chunk assembly, and childprocess obtained via string concatenation (require("child" + "process")).

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "35.3.3"
            ],
            "id": "IN-MAL-2026-015368",
            "import_time": "2026-08-05T15:19:47.39689764Z",
            "modified_time": "2026-08-05T14:36:31Z",
            "source": "amazon-inspector",
            "sha256": "3bc4c244c6348b8ac4006067e983f7a3a58a7d00c5356d10d8d452c02823d1e1"
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-mobile-bnpl-shopping-header

Package

Name
bnpl-blocks-mobile-bnpl-shopping-header
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-mobile-bnpl-shopping-header

Affected ranges

Affected versions

35.*
35.3.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-mobile-bnpl-shopping-header/MAL-2026-13006.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "bnpl-blocks-mobile-bnpl-shopping-header-35.3.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-PBlo3D7C6zP52KlLHQ0AweVaxBHNHTUU9s5HK5bwqxH6OHRB/OgIWRn201yjkVT6fu2/YYLWb3vUMBF7qbl4Ag==",
                "sha1": "e8998e6b3962be86dd6e62456576b661cce97eb3"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_init.js",
            "tlsh": "49a1a66a12a671188bb0dbe5c7175415f65bf2633380c294fb9c69985ff311482b2efc",
            "sha256": "a0b3321b054a27990ae9b025fc7321fad99feb0f1bfd38dc2b9271826fc99f29"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "2a835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "2d67603f09d2139d7115a2e804b16aab5bee57ea880c0cb65af2669ed5533f43"
        }
    ]
}