bnpl-blocks-atom-bnpl-feedback @35.7.5
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-12875
Ecosystem
npm
Summary
On require('bnpl-blocks-atom-bnpl-feedback'), index.js loads _bridge.js which selects a platform-specific asset, downloads an unsigned binary via HTTPS from string-split-obfuscated Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev) with a base64-over-DNS-TXT covert-channel fallback resolving under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache_<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh or cmd. The package's stated purpose is a 'data mapper' and index.js exports a trivial no-op class with no dependencies, contradicting the network-dropper behavior implemented in _bridge.js. Hostnames are reconstructed at runtime from split string arrays joined with empty separators to evade static matching.
Source: amazon-inspector (058b0a78e0960f56198334ba1623fa948a0b198e4480910e73e44e48ad2704d0)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.