bnpl-blocks-atom-bnpl-email-form @35.3.9

Summary

Requiring the package's main entry transitively loads _init.js , which selects an OS/architecture-specific endpoint and downloads a binary from one of four hostname-obfuscated Cloudflare Workers mirrors (hostnames reconstructed via string split-join, e.g. oob-worker.cf100-416.workers.dev ). If HTTPS mirrors fail, a DNS-TXT covert channel under *.dl.wel1.ru (subdomains sdk , ext , pkg , net ) reconstructs the payload from base64 TXT chunks ( c.<domain> for chunk count, <i>.<domain> for chunks). The fetched bytes are written to /var/tmp/.cache_<hex> on POSIX or %TEMP%/dotnet_diag_<hex>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b . Cover-story naming ( analytics_state , DISABLE_TELEMETRY , dotnet_diag_*.exe ) disguises the behavior. A second dropper implementation with the same fetch-write-chmod-spawn chain is bundled as lib/telemetry.js (framed as an 'Analytics SDK'), using string-split obfuscation of require("child_" + "process") and fs["chmod"+"Sync"] to evade scanners. Fires on any require() / import of the package with no consent, no version pinning, and no integrity verification.

Source: amazon-inspector (4990414fbbea6c3a7c19539ac76eeee019ae4657756545743b4b54bdece4a135)