🛡️ MAL-2026-12991 — bnpl-blocks-mobile-bnpl-header

Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

Source: amazon-inspector

On require() of the package, index.js loads _bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-over-TXT base64 fallback to *.wel1.ru. The retrieved bytes are written to a hidden path in /var/tmp or %TEMP% under masquerading names (.cache_<rand> on Unix, dotnet_diag_<rand>.exe on Windows), chmodded to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start. Destination hostnames are reconstructed at runtime from split string fragments joined with.join(""), and the drop is gated by DISABLE_TELEMETRY / DO_NOT_TRACK environment checks to present as opt-out telemetry. A freshness marker is written to /tmp/.analytics_state. The package presents itself as a mobile BNPL SDK; none of the fetch-write-execute behavior relates to that stated purpose.