bnpl-blocks-atom-bnpl-info-card @35.7.3
Vulnerability report · Last retrieved from osv.dev August 8, 2026 at 9:15 PM UTC
OSV ID
MAL-2026-12878
Ecosystem
npm
Summary
On require() of index.js, the package auto-loads _platform.js which reconstructs destination hostnames from split-string fragments (e.g. 'oob-wor'+'ker.cf101-adf.wor'+'ke'+'rs.d'+'ev' and 'sdk.dl.wel1.'+'ru') to contact Cloudflare Workers subdomains oob-worker.cf10{0-3}-*.workers.dev and *.dl.wel1.ru, with a secondary DNS-TXT covert channel that resolves TXT records under c.<domain> and reassembles a base64-encoded binary from the returned chunks. The resulting binary is written to /tmp or %TEMP% under cover names (dotnet_diag_*.exe,.cache_*), chmod'd to 0755, and executed via a detached cp.spawn('/bin/sh', ['-c', path+' &'], {detached:true}) or cmd equivalent. A second module lib/telemetry.js (~81 KB) is bundled with the same DNS-service-discovery, base64 payload assembly, chmod 0755, and detached /bin/sh spawn shape, indicating a parallel backup dropper. Installing or requiring the package yields full-host remote code execution on the installer.
Source: amazon-inspector (369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.