bnpl-blocks-atom-bnpl-breadcrumbs @35.8.2

Summary

On require() of the package, index.js loads _polyfill.js, which fetches a platform-specific opaque binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf100-*.workers.dev, oob-worker.cf101-*.workers.dev, etc.) and, if HTTPS delivery fails, falls back to reassembling the payload from base64-encoded DNS TXT records under *.dl.wel1.ru (query c.<domain> for a chunk count, then concatenate N.<domain> TXT records). The retrieved bytes are written to /var/tmp or %TEMP% under a disguised filename (.cache_<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755'd, and detach-spawned via /bin/sh -c "<file> &" or cmd /c start, with.unref() so the process outlives the require() call. C2 hostnames are assembled at runtime by array-join splits (["oob-","worker.cf10","0-416.w","orkers.d","ev"].join(""), ['sdk.dl.wel1','.ru'].join("")) to defeat static string scanning, and the code respects DO_NOT_TRACK/DISABLE_TELEMETRY environment variables as a review-evasion gate. The staged filenames impersonate legitimate diagnostic tooling and a hidden marker file (.analytics_state) is used to track prior execution. No verification (hash, signature, pinning) is performed on the fetched binary.

Source: amazon-inspector (35d35af02d640655669a475465b8fc992dc8b79950584824dab0e86c285f8b01)