bnpl-blocks-atom-bnpl-link-avatar @35.4.8

Summary

On require() of the package, index.js loads _polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded Cloudflare Workers hostnames (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev), with a DNS-TXT base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The binary is written to /tmp or %TEMP% under disguised names (.cache_<rnd> on POSIX, dotnet_diag_<rnd>.exe on Windows), chmod 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. There is no hash or signature verification and the destinations are not publisher-owned infrastructure. Destination hostnames are reassembled at runtime from string fragments joined together, a.analytics_state marker file gates re-execution, and DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK env vars are consulted as a cover story. The package's public API (index.js) is a no-op stub class and the name follows a scoped-ecosystem naming pattern, consistent with a dependency-confusion or typosquat lure whose sole effect on install is the dropper.

Source: amazon-inspector (3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d)