bnpl-blocks-atom-bnpl-anchor-menu @35.8.5

Summary

On require of bnpl-blocks-atom-bnpl-anchor-menu, index.js loads _loader.js which assembles hostnames from split-string arrays (evading static analysis), selects a platform-specific asset, and downloads an opaque executable via https.get from Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS-TXT base64 fallback resolving sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp or the Windows temp directory under cover-story names (dotnet_diag_*.exe,.cache_*), chmodded 0755 on POSIX, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() (spawn("cmd") equivalent on Windows). The package's declared purpose is a UI anchor menu, which does not require fetching or executing native binaries from anonymous workers.dev hosts. A sibling module lib/telemetry.js contains a parallel dropper implementation with the same chmod-and-spawn primitives, activating if imported directly. The combination of split-string obfuscation of destination hosts, cover-story staging paths, anonymous workers.dev C2 with a Russian DNS-TXT covert channel, and unconditional execute-on-require constitutes remote code execution against every installer that requires the package.

Source: amazon-inspector (2c841de8c355f3970534d5ec0f0c5eb63ed72a4d70f8d715c2e781c276acdb20)