bnpl-blocks-atom-bnpl-navigation-arrow @35.2.6

Summary

Requiring this package executes _platform.js, which detects the host OS/arch, fetches an opaque binary from one of four author-controlled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT base64 fallback resolved via subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to /var/tmp/.cache_<hex> on Unix or TEMP/dotnet_diag_<hex>.exe on Windows disguised as a system artifact, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start. All destination hostnames, resolver domains, and even the child_process module name are assembled from split string literals (e.g. ["oob-worke","r.cf103-07","0.worke","rs.de","v"].join(""), require("child_" + "process")) to evade signature-based scanners. A second copy of the dropper is bundled in lib/telemetry.js under an 'analytics SDK' cover story, containing the same base64 buffer construction, fs["chmod" + "Sync"] to 0755, and cp.spawn("/bin/sh", ["-c", filePath + " &"]) primitives.

Source: amazon-inspector (ac730391d7dd3e3b320792e22983d3d225a08701364594a2db02d8c19f1bf868)