bnpl-blocks-mobile-bnpl-documents @35.1.2

Summary

The package's main entry require()s./_compat on load. _compat.js runs an async init() at module load that fetches an opaque binary from hardcoded Cloudflare Workers subdomains (oob-worker.cf*.workers.dev), with a DNS-TXT fallback under sdk.dl.wel1.ru that base64-reassembles bytes. Destination hostnames are string-joined at runtime from substring arrays to defeat static URL scanning. The fetched bytes are written to a temp path under cover-story filenames (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmod 0755'd, and launched detached and unref'd via cmd.exe /c start /b or /bin/sh -c '<path> &'. A second dropper implementation in lib/telemetry.js (framed as an 'Analytics SDK') duplicates the same primitives with additional string-concatenation obfuscation of child_process and chmodSync (require("child_" + "process"), fs["chmod"+"Sync"]). Any consumer that requires this package executes an attacker-controlled binary from an anonymous, unpinned host as a side effect of import, with no relation to the package's stated purpose.

Source: amazon-inspector (988d216f062a1183358e442ea59c16497355dea792b1be8a7de103de649f2f56)