🛡️ MAL-2026-12554 — checkout-desktop-bnpl

Malicious code in checkout-desktop-bnpl (npm)

Source: amazon-inspector

The package presents itself as a checkout/BNPL library but exports an empty CheckoutDesktopBnpl class with no BNPL functionality. On require() of the main module, index.js loads _polyfill.js, which selects a platform-specific remote endpoint, downloads a binary payload, writes it to /tmp or %TEMP% under decoy names such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd. Destination hostnames are obfuscated via array-join string splitting and resolve to Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-over-TXT fallback channel that queries c.<domain> and N.<domain> TXT records at sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, base64-decodes the concatenated chunks, and executes the reassembled binary. There is no hash or signature verification, and the delivery hosts are unpinned and attacker-controlled. Any process that imports this package triggers arbitrary remote code execution on the installer's machine.