bnpl-blocks-atom-bnpl-image @35.2.9

Summary

On require() of the package, index.js loads _runtime.js which downloads a platform-specific executable from attacker-controlled hosts whose names are reconstructed at runtime via split-string concatenation (oob-worker.cf1{01,02,03}*.workers.dev and {sdk,ext,pkg,net}.dl.wel1.ru), writes the payload to a temp directory under a disguised name (dotnet_diag_<hex>.exe on Windows, hidden.cache_<hex> on Unix), chmods 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. A DNS-TXT-over-base64 fallback channel is present. Env-var kill switches (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a /tmp/.analytics_state stamp implement session dedup and evasion. A second file lib/telemetry.js (not currently referenced from index.js) ships the same drop-and-exec primitive with split require("child_"+"process") obfuscation and base64-reconstructed payload chunks.

Source: amazon-inspector (65c88f06629de21bc094c8b6767cfe524db6b348eb0c7a32b4f54ef1447376f2)