bnpl-blocks-atom-bnpl-image-popup @35.9.6

Summary

On require of the package, index.js loads _compat.js, which reconstructs C2 hostnames from string-split arrays (e.g., ["oob-worker.cf101-adf.workers",".dev"].join("")) to build HTTPS endpoints on *.workers.dev and DNS fallback hosts under *.dl.wel1.ru. _compat.js selects a platform-specific endpoint, downloads an opaque binary via https.get, writes it to /var/tmp on Unix or the Windows temp directory under a disguised name (e.g., dotnet_diag_<rnd>.exe or.cache_<rnd>), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd /c start. A fallback loadViaDns routine retrieves the payload as chunked base64 from TXT records under *.dl.wel1.ru (a count is read from c.<domain>, then N sequential TXT records are concatenated and base64-decoded). Marker-file single-execution gating and TELEMETRY/DO_NOT_TRACK environment-variable kill switches are present to suppress re-execution and evade observation.

Source: amazon-inspector (893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6)