bnpl-blocks-atom-bnpl-integrations-breadcrumbs @35.2.9

Summary

On require(), the package's main entry loads _ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames (e.g. oob-worker.cf103-070.workers.dev and additional Cloudflare Workers subdomains) with a DNS TXT fallback via *.dl.wel1.ru, downloads a platform-specific binary via https.get, writes it to a temporary path under a disguised name (.cache_<hex>, dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via spawn("/bin/sh",["-c", fp+" &"], {detached:true}) on Unix or cmd.exe start /b on Windows. require("child_process") is itself reconstructed via string concatenation. No hash or signature verification is performed and the fetch destinations are anonymous, mutable, author-controlled hosts unrelated to any documented publisher. The package name and cover-story comments reference "session tracking" and "telemetry" but the traced behavior is a staged binary dropper.

Source: amazon-inspector (d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60)