{"schema_version":"1.8.0","id":"MAL-2026-12173","published":"2026-08-05T09:11:04Z","modified":"2026-08-05T10:06:04.803859033Z","summary":"Malicious code in bnpl-blocks-desktop-bnpl-documents (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0)\nOn require of the package, index.js loads./setup, which selects a platform-specific URL, fetches an opaque binary from string-concatenated Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, cf103-070.workers.dev, cf102-baf.workers.dev), writes it to /var/tmp/.cache_<hex> on POSIX or %TEMP%\\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh or cmd. Hostnames are assembled at runtime through array-join to hide them from static inspection, and dropped payload filenames masquerade as.NET diagnostics artifacts. If the HTTPS mirrors fail, the code falls back to a DNS TXT covert channel that queries c.<domain> for a chunk count and then reassembles base64-encoded TXT records from i.<domain> across *.dl.well1.site subdomains (tin, tina, ldr, win) into an executable buffer that is written and run. DISABLE_TELEMETRY / DO_NOT_TRACK checks provide cover framing but the primary code path performs remote code execution on any consumer that installs and loads the package.\n","affected":[{"package":{"name":"bnpl-blocks-desktop-bnpl-documents","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-desktop-bnpl-documents"},"versions":["20.7.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"0fecef262268871fad8d0547b75ffa5410ef42bc8e3d427b67f739330479596d","tlsh":"1fa1ba9606aa701947b0dbe4871b441af66be7533380c5d4fb9c59980fb6124c3b2dfc"}],"package_integrity":[{"filename":"bnpl-blocks-desktop-bnpl-documents-20.7.2.tgz","hashes":{"sha1":"080dadde12856f1eedac45a0ea7fd189570803f6","sha512_sri":"sha512-vBnG3BAEj+QTX7i5aQ6nJxuUUh2gzWVdcpTy6C0lj30go9Nwhklco0WbaXncN7fhzVHDYxm2GbwDsoFN2RDMWg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-desktop-bnpl-documents/MAL-2026-12173.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-desktop-bnpl-documents/v/20.7.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014580","import_time":"2026-08-05T09:28:27.48405354Z","modified_time":"2026-08-05T09:11:04Z","sha256":"a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0","source":"amazon-inspector","versions":["20.7.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}