bnpl-blocks-independent-bnpl-tiles @35.8.9
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-12973
Ecosystem
npm
Summary
On require() of this package, index.js loads _adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split character arrays (Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, cf103-070/cf99-9b3/cf102-baf.workers.dev and.ru fallbacks sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), fetches an opaque binary over HTTPS, writes it to a temp path under a cover-story name (dotnet_diag_<hex>.exe /.cache_<hex>), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT covert channel fetches a base64-chunked payload via numbered TXT records when HTTPS is blocked. The host strings are split into arrays and rejoined at runtime to defeat static inspection, and no hash or signature verification is performed on the fetched bytes. Import (require/load) of the module triggers the download-and-execute path unconditionally, giving remote code execution on the installer's machine.
Source: amazon-inspector (56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.