bnpl-api @35.9.5

Summary

The package presents itself as an empty API stub (index.js exports a no-op BnplApi and unconditionally require("./_support") on load). _support.js assembles download hostnames via array-join string splitting ( ["oob-worke","r.cf103-070.w","or","kers",".d","ev"].join("") ) to reconstruct three anonymous Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), fetches a platform-specific native executable, writes it to /tmp or %TEMP% under a disguised name ( .cache_<hex> or dotnet_diag_<hex>.exe ), chmods it 0755, and spawns it detached via spawn("/bin/sh",...) / spawn("cmd",...) . If HTTPS retrieval fails, a DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru reassembles a base64-encoded binary from numbered TXT records and executes it the same way. lib/telemetry.js also loads child_process via require("child_"+"process") to evade static scanners. The package has no legitimate functionality; its only on-load effect is running an opaque attacker-controlled binary on the installer's host.

Source: amazon-inspector (2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4)