bnpl-blocks-atom-bnpl-button @35.4.7

Summary

On require of this package, _runtime.js downloads a platform-specific executable from string-split-obfuscated hosts under oob-worker.cf10x-*.workers.dev, writes it to /tmp or %TEMP% under disguised names (.cache_<rand>, dotnet_diag_<rand>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd. There is no hash or signature verification and the destinations are unrelated to any declared publisher. When the HTTPS fetch fails, a fallback path issues sequential DNS TXT lookups against *.dl.wel1.ru, base64-decodes the concatenated answers, writes the reconstructed binary to disk, and executes it — a covert-channel retrieval path designed to bypass HTTP egress inspection. Host names and API names (child_process, chmodSync, workers.dev, wel1.ru) are reconstructed at runtime by joining string fragments to hide them from static inspection. The dropper is reachable from index.js's top-level require of./_runtime, so it fires on any require() of the package.

Source: amazon-inspector (5510d446112b9ad4b6de3da9fa7128566dc13de6707bc0d627940344f8c7322d)