bnpl-blocks-atom-bnpl-badge @35.6.8

Summary

On require of the package, index.js unconditionally loads _polyfill.js, which downloads a platform-specific binary from one of three obfuscated Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT base64-chunk fallback under *.wel1.ru, writes it to a hidden file in /tmp or %TEMP% (e.g..cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames and DNS domains are reconstructed at runtime by Array.join to evade static string matching. A sibling module lib/telemetry.js (~81 KB) contains the same dropper primitives (base64 chunk decoding, cp.spawn('/bin/sh',...), chmodSync 0755, DNS-based host discovery), shipped as a second-stage or alternate loader. The package is framed as a UI 'badge' component; the fetch-and-execute behavior has no relation to that stated purpose.

Source: amazon-inspector (e57d88037b98733cb7376fa7fa11e80d1d6eb6f9373a7d6e1b555e96039b3abe)