MAL-2026-13528
Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (bcd2fbb910548df40180cd1e71ae6234dddbd8c60b871933d9012bab9f0742bb) The package's main entry (index.js) requires./_ext at module load. _ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) — assembled via string-split/join to defeat static scanners — with a DNS-TXT chunked-download fallback under *.dl.wel1.ru (c.<domain> for chunk count, <i>.<domain> for base64 payload chunks). The fetched bytes are written to /var/tmp/.cache_<rnd> on POSIX or %TEMP%\dotnet_diag_<rnd>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd. A stamp file named.analytics_state and the dotnet_diag_* filename disguise are used to blend into normal system activity. Any require()/import of the package triggers download-and-execute of opaque attacker-controlled code on the installer's machine.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for bnpl-blocks-atom-bnpl-faq-item (npm). Pin to a known-safe version or switch to an alternative.