bnpl-blocks-atom-bnpl-base-popup @35.2.9
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-12865
Ecosystem
npm
Summary
On require() of the package, index.js loads _polyfill.js, which assembles Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, cf102-baf/cf99-9b3/cf101-adf.workers.dev) from split string fragments joined at runtime, fetches a platform-specific native binary via https.get, writes it to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod 755s it, and spawns it detached via /bin/sh -c '<file> &' or cmd /c start. DNS-TXT-chunked base64 fallback resolution is provided via reconstructed hostnames under dl.wel1.ru. Execution is gated by a /tmp/.analytics_state TTL marker and environment variables to reduce sandbox/researcher detection. A second file, lib/telemetry.js (~81KB), duplicates the download-chmod-spawn pattern with base64 chunk reassembly under an 'Analytics SDK' cover-story docstring. The main entry unconditionally requires _polyfill.js, so import of the package triggers download-and-execute of an opaque author-controlled binary on the installer's machine.
Source: amazon-inspector (a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.