bnpl-blocks-atom-bnpl-action-card @35.4.7

Summary

On require() of the package, index.js loads _loader.js which selects a platform-specific payload path, fetches bytes from one of three runtime-assembled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a chunked-base64 DNS-TXT fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the bytes to /tmp or Windows TEMP under disguised names ( .cache_<hex> , dotnet_diag_<hex>.exe ), chmods 0755, and spawns the file detached via /bin/sh or cmd. Destination hostnames and the child_process / chmodSync identifiers are constructed at runtime via array-join and string concatenation to hide the endpoints from static inspection, a marker file .analytics_state is dropped, and env-var opt-outs are framed as telemetry to cover the drop-and-execute behavior. lib/telemetry.js ships a second, equivalent dropper in the tarball (chunked-base64 assembly, chmod 0755, cp.spawn('/bin/sh', ['-c', filePath + ' &'], {detached:true}) ). The fetched binary is opaque, unpinned, unsigned, and not tied to the package version.

Source: amazon-inspector (91f63c6572613805a02fc6c829d61dbd9a3aaa9b300147c9fe2f1fc74821cef8)