{"schema_version":"1.8.0","id":"MAL-2026-12886","published":"2026-08-05T14:54:33Z","modified":"2026-08-05T15:50:42.842137278Z","summary":"Malicious code in bnpl-blocks-atom-bnpl-product-card (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45)\nindex.js requires./_bootstrap.js on load. _bootstrap.js selects a per-OS asset path, then attempts to download an opaque binary from a rotated list of split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev). On failure it falls back to a DNS-TXT covert channel reassembling a base64 payload from TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The bytes are written to a disguised path in /var/tmp or %TEMP% (.cache_<uid> on POSIX, dotnet_diag_<uid>.exe on Windows), chmod 0o755 on POSIX, and detached-spawned via /bin/sh -c '<file> &' or cmd /c start /b. Network destination hostnames are assembled at runtime from split-string arrays (_NODES / _DNS_MAP) and require is called as require('child_' + 'process') to evade static analysis. On-disk artifact names and env-var opt-outs (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) impersonate a benign telemetry SDK, and lib/telemetry.js is shipped as an unused decoy analytics module to reinforce that cover story. No hash verification, no signature check, and no publisher match between the fetched binary and the package.\n","affected":[{"package":{"name":"bnpl-blocks-atom-bnpl-product-card","ecosystem":"npm","purl":"pkg:npm/bnpl-blocks-atom-bnpl-product-card"},"versions":["35.6.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_bootstrap.js","sha256":"205a1f13851c82b34c130fc50882c1996cbf4fb157c115c30d325bb9243dff6d","tlsh":"92a1869a156670188b70dbe486174816f65bf6a33680c6c4fbac59981f7712483b2dfc"}],"package_integrity":[{"filename":"bnpl-blocks-atom-bnpl-product-card-35.6.4.tgz","hashes":{"sha1":"267b99f47ea0c45f3ce874a53b19f60ec3da2c29","sha512_sri":"sha512-IrLQEdwHiSJplnyfKGbw5jBDnniw9Jva3wtNwuiUcEniNe2p1UKA0sZWblrPV/w+LkY95QxiN925F6dAcoZwJw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bnpl-blocks-atom-bnpl-product-card/MAL-2026-12886.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bnpl-blocks-atom-bnpl-product-card/v/35.6.4"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015491","import_time":"2026-08-05T15:19:54.166489888Z","modified_time":"2026-08-05T14:54:33Z","sha256":"66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45","source":"amazon-inspector","versions":["35.6.4"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}