🛡️ MAL-2026-12985 — bnpl-blocks-mobile-bnpl-container

Malicious code in bnpl-blocks-mobile-bnpl-container (npm)

Source: amazon-inspector

The package's main entry requires./_compat on load, which selects a platform-specific payload (Windows.exe, Linux ELF, macOS Mach-O), downloads it over HTTPS from one of three anonymous *.workers.dev hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT fallback channel that reassembles a base64 payload from numbered subdomains under wel1.ru. The fetched bytes are written to a disguised temp filename (dotnet_diag_<hex>.exe /.cache_<hex>), chmod 0755, and spawned detached via /bin/sh or cmd. Destination hostnames are reconstructed at runtime from array-joined string fragments to evade static matching. No hash or signature verification is performed. The package presents itself as a trivial platform adapter; the fetch-and-execute behavior is inconsistent with that stated purpose and is hidden behind DISABLE_TELEMETRY env-var opt-outs.