bnpl-blocks-analytics @35.3.8

Summary

On require('bnpl-blocks-analytics'), index.js loads _compat.js whose top-level start() function downloads an OS-specific binary from Cloudflare Workers hosts assembled at runtime by joining split string arrays (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT base64 fallback resolving to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under masquerading names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmodded to 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', filePath+' &']) or cmd equivalent. No signature or hash verification is performed. A parallel dropper implementation is bundled in lib/telemetry.js, framed as an 'analytics SDK', using base64-chunk decoding and the same chmod+spawn pattern. Destination hostnames are obfuscated via string-array.join() and the payload filenames impersonate.NET diagnostic tooling.

Source: amazon-inspector (e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1)