MAL-2026-13021

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-types-gen/MAL-2026-13021.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13021
Published
2026-08-05T14:33:28Z
Modified
2026-08-05T15:51:45.233599513Z
Summary
Malicious code in bnpl-blocks-types-gen (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5)

On require('bnpl-blocks-types-gen'), top-level code in index.js invokes setup() in platform.js, which selects a platform-specific binary path, downloads bytes from one of three Cloudflare Workers hosts whose names are assembled from split string literals (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes them to /var/tmp/.cache<rand> or %TEMP%\dotnetdiag<rand>.exe, chmods 0755, and spawns the binary detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, a DNS TXT-record fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru reconstructs a base64-chunked payload from TXT records and executes it the same way. Hostnames and the require('child_process') call are obfuscated via Array.join() from split literals to evade static analysis. Delivery is unpinned and unverified, the disguised filenames masquerade as OS cache/diagnostic files, and the fetched content bears no relation to the package's stated 'lightweight wrapper' purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5",
            "id": "IN-MAL-2026-015348",
            "modified_time": "2026-08-05T14:33:28Z",
            "import_time": "2026-08-05T15:19:46.321286423Z",
            "source": "amazon-inspector",
            "versions": [
                "35.4.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bnpl-blocks-types-gen

Package

Name
bnpl-blocks-types-gen
View open source insights on deps.dev
Purl
pkg:npm/bnpl-blocks-types-gen

Affected ranges

Affected versions

35.*
35.4.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ed7bbf97ae6b1acbcc544655ada98c0c3ac7f0ce3b7b4439c63c90ead1e610f8",
            "path": "_platform.js",
            "tlsh": "83a1769a16a971198bb0ebf4c7175419f65af6633380c2c4f76c65941fb212483b2efc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-OKHu8EeiCeII5rK0I1TFY+x44In18WcDJEu3SglnCbsTVVwaZpgZ5OKbGAeQ0wynj+wuv23tPJB3MY27G+3jdA==",
                "sha1": "8987fa72ac5089ed54b5767a78fe3f5efe84417c"
            },
            "filename": "bnpl-blocks-types-gen-35.4.4.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-types-gen/MAL-2026-13021.json"