bnpl-blocks-atom-bnpl-dangerously-html @35.2.4

Summary

On any require() of this package, index.js loads _compat.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers (oob-worker.cf101-*.workers.dev, oob-worker.cf102-*.workers.dev, oob-worker.cf99-9b3.workers.dev) and *.dl.wel1.ru hosts (sdk, ext, pkg, net subdomains), with a DNS-TXT base64 fallback channel (c.<domain>, 0.<domain>, 1.<domain>... TXT records reassembled and base64-decoded). Destination hostnames are assembled at runtime from split-string fragments joined together to evade static analysis. The downloaded binary is written to /var/tmp or the OS temp directory under disguising names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. The package name references legitimate BNPL block terminology as cover; the actual behavior is a load-time binary dropper with obfuscated multi-channel C2.

Source: amazon-inspector (168aaa53563331be51ccf856023735e18048226dacc413d15a9252e1f1c085c9)