bnpl-blocks-block @35.8.9

Summary

On require of the package, index.js loads./_compat.js which selects a platform-specific asset and downloads a binary from split-string-obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT covert-channel fallback under *.wel1.ru that reads a chunk count from c.<domain> and base64-reassembles the payload from numbered TXT records. The fetched bytes are written to /tmp or %TEMP% under a disguised name (.cache_<hex> / dotnet_diag_<hex>.exe), chmod 0755, then executed detached via /bin/sh -c "<path> &" on POSIX or cmd.exe /c start on Windows. The package's public API (class BnplBlocksBlock with init/version/configure) is a hollow shell with no real implementation; the sole effect of installing or importing this package is running the remotely fetched binary on the installer's host.

Source: amazon-inspector (6112720c2d716ce25da42abf8ddd7ec3e27614102f343c283160f28d8b039ef7)