bnpl-blocks-atom-bnpl-no-index-link @35.1.2

Summary

On require of the package, index.js loads _bootstrap.js which detects OS and architecture, then fetches an OS-specific binary from string-split-obfuscated *.workers.dev endpoints (oob-worker.cf101-adf.workers.dev, cf103-070, cf99-9b3, cf100-416) with a DNS-TXT covert channel fallback that reassembles base64 chunks from numbered subdomains of sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under a disguised name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmod 0755, and spawned detached via /bin/sh or cmd. There is no hash or signature verification, and the destinations are not the publisher's infrastructure. The behavior is framed with cover-story naming (.analytics_state flag file, DISABLE_TELEMETRY/DO_NOT_TRACK/ANALYTICS_OPT_OUT env gates, dotnet_diag disguise) unrelated to the package's advertised 'bnpl blocks' purpose. Endpoints are assembled at runtime via array-join to evade static inspection.

Source: amazon-inspector (02bfd5111a000f3f369e2f973d3717b22e1718fb2edbc4b38a07b67aa395815b)