🛡️ MAL-2026-12952 — bnpl-blocks-independent-bnpl-cards

Malicious code in bnpl-blocks-independent-bnpl-cards (npm)

Source: amazon-inspector

On require of the package, index.js loads _bridge.js which reconstructs attacker-controlled hostnames via array.join("") string splits (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, with a DNS-TXT chunked base64 fallback via *.sdk.dl.wel1.ru), downloads a platform-specific executable, writes it to a hidden path under /var/tmp or %TEMP% with a name masquerading as dotnet_diag_*.exe or.cache_*, chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe with.unref(). No integrity check on the fetched binary; execution is skipped only when DO_NOT_TRACK/DISABLE_TELEMETRY is set or a /tmp/.analytics_state marker file exists. Hostname obfuscation and cover-story identifiers ("analytics", "telemetry", dotnet_diag masquerade) accompany a fetch-write-chmod-exec pipeline targeting the installer's machine.