MAL-2026-13019

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-stories-of-block/MAL-2026-13019.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13019
Published
2026-08-05T14:35:51Z
Modified
2026-08-05T15:51:44Z
Summary
Malicious code in bnpl-blocks-stories-of-block (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121)

On require() of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of attacker-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a temp path with a disguised name (dotnet_diag.exe on Windows,.cache_ on POSIX), chmods it to 0755, and spawns it detached via cmd.exe /c start or /bin/sh -c. Destination hostnames are reassembled at runtime via array split +.join("") to evade static analysis, and child_process is required as require("child_"+"process"). If the HTTPS mirrors fail, bootstrap.js falls back to a DNS-TXT covert channel under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru): it queries a count record and N sequential TXT records, base64-decodes and concatenates them into an executable buffer, then writes and spawns it with no signature or hash verification. Cover-story naming (analytics_state marker, dotnet_diag*.exe, DISABLE_TELEMETRY/DO_NOT_TRACK env opt-outs) does not alter that this is arbitrary remote code execution on the installer's host on module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015364",
            "import_time": "2026-08-05T15:19:47.215971959Z",
            "modified_time": "2026-08-05T14:35:51Z",
            "sha256": "a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121",
            "source": "amazon-inspector",
            "versions": [
                "35.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-stories-of-block

Package

Name
bnpl-blocks-stories-of-block
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-stories-of-block

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_bootstrap.js",
            "sha256": "ba36be5ecfdb147604c521aa222c6c09b58c8603c472377eacc4dd313a460954",
            "tlsh": "beb1a69a12a670188bb0e7e4c71b8816f65bf6633391c284fb5ca5945f735248372efc"
        }
    ],
    "package_integrity": [
        {
            "filename": "bnpl-blocks-stories-of-block-35.8.1.tgz",
            "hashes": {
                "sha1": "e517a9934c61f3653974cbd37f357352bcca379e",
                "sha512_sri": "sha512-bqSHFVTd0LTkEercSZjeSO4f9Q3XqAQIKGGOjZrhz9c8GqsYftW6N3gMw3K0HXtRWnIDV6+vjotGmrgkAK1CFQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-stories-of-block/MAL-2026-13019.json"