bnpl-blocks-independent-bnpl-open-api @35.1.2
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-12963
Ecosystem
npm
Summary
On require() of bnpl-blocks-independent-bnpl-open-api, index.js loads _support.js which unconditionally executes at module load. _support.js selects a per-OS URL, downloads a binary over HTTPS from hardcoded Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), writes the payload to a hidden file in a temp directory using cover-story names such as.cache_<uid>,.analytics_state, and dotnet_diag_, chmods it 0755 on Unix, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed. Hostnames are assembled at runtime by joining split string fragments (e.g. ["oob-worker.cf101-adf.workers",".dev"].join("")) to defeat plain-text scanning, and child_process is loaded via require("child_" + "process") in lib/telemetry.js. A DNS-TXT base64 fallback channel is provided using resolvers sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.we1.ru. The download destinations and payload are unrelated to the package's stated purpose as a BNPL open API SDK.
Source: amazon-inspector (10c2ca153491f56216bdb6e7d85fcaa5ce9fc15c7cb412b4291f1657c387c9d0)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.