🛡️ MAL-2026-12997 — bnpl-blocks-mobile-bnpl-navigation

Malicious code in bnpl-blocks-mobile-bnpl-navigation (npm)

Source: amazon-inspector

On require of the package's main, index.js unconditionally loads _bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime from split string fragments (e.g. 'oob-worker.cf100-416.workers.dev', 'cf103-070.workers.dev', 'cf102-baf.workers.dev'), with a DNS-TXT base64-chunked fallback resolving over sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a hidden temp path of the form.cache_<rand>/dotnet_diag_<rand>.exe, chmod 0755 on POSIX, and spawned detached via /bin/sh -c on POSIX or cmd on Windows. There is no hash or signature verification, the destination hosts are obfuscated by string-split concatenation, and lib/telemetry.js exhibits the same reconstruct-fetch-write-chmod-spawn pattern with require("child_" + "process"). The package is presented as 'telemetry', but the code path is an unsigned unpinned remote-code loader that executes attacker-controlled bytes on any machine that installs or requires the package.