bnpl-blocks-atom-bnpl-dolyame-button @35.1.8

Summary

On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded Cloudflare Workers hostnames (oob-worker.cf103-07.0.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, writes the payload to a disguised temp path, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start. Destination hostnames and sensitive API names (child_process, chmodSync) are reconstructed at runtime from arrays of string fragments to defeat string scanners. Opt-out environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a benign 'analytics_state' filename are used as cover. There is no pinning, no signature check, and the destinations are unrelated to the package publisher. Installing or requiring the package causes an attacker-controlled binary to run on the host.

Source: amazon-inspector (953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277)