🛡️ MAL-2026-12909 — bnpl-blocks-data-schema-generator

Malicious code in bnpl-blocks-data-schema-generator (npm)

Source: amazon-inspector

index.js unconditionally requires _bootstrap.js, which on module load reconstructs Cloudflare Workers subdomains (oob-worker.cf10x-xxx.workers.dev) and *.dl.wel1.ru hosts from split string fragments, fetches a platform-specific executable via https.get with a DNS-TXT fallback that reassembles base64 chunks from numbered subdomains, writes the payload to a temp path under disguised names (e.g. dotnet_diag_*.exe,.cache_*), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start. A second file lib/telemetry.js labelled as a telemetry SDK contains the same write+chmod+spawn primitives (Buffer.from(chunks,'base64'), cp.spawn('/bin/sh',['-c', filePath+' &']), fs['chmod'+'Sync'](extensionPath, 0755)) as a redundant dropper. The behavior fires whenever any consumer require()s the package, giving arbitrary remote code execution on the installer's host.