Malicious code in bnpl-blocks-independent-bnpl-open-api (npm)
On require() of bnpl-blocks-independent-bnpl-open-api, index.js loads _support.js which unconditionally executes at module load. _support.js selects a per-OS URL, downloads a binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), writes the payload to a hidden file in a temp directory using cover-story names such as.cache_<uid>,.analytics_state, and dotnet_diag_, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed. Hostnames are assembled at runtime by joining split string fragments (e.g. ["oob-worker.cf101-adf.workers",".dev"].join("")) to defeat plain-text scanning, and child_process is loaded via require("child_" + "process") in lib/telemetry.js. A DNS-TXT base64 fallback channel is provided using resolvers sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.we1.ru. The download destinations and payload are unrelated to the package's stated purpose as a BNPL open API SDK.
MAL-2026-12963 is recorded against 1 package.
Published on 5 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| bnpl-blocks-independent-bnpl-open-api | — | — |
References
Free Vulnerability Check
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-12963 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
Stay up to date with the latest from Boteraser.
We use cookies to improve your experience on our site. By using our site, you consent to cookies.
Manage your cookie preferences below:
Essential cookies enable basic functions and are necessary for the proper function of the website.
CloudFlare provides web performance and security solutions, enhancing site speed and protecting against threats.
Service URL: developers.cloudflare.com (opens in a new window)
These cookies are needed for adding comments on this website.
These cookies are used for managing login functionality on this website.
Statistics cookies collect information anonymously. This information helps us understand how visitors use our website.
Google Analytics is a powerful tool that tracks and analyzes website traffic for informed marketing decisions.
Service URL: policies.google.com (opens in a new window)
You can find more information in our Cookie Policy and Privacy Policy.