bnpl-blocks-mobile-bnpl-grid-container @35.7.1

Summary

On require of the package, index.js loads _runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments (resolving to oob-worker.cf10{0,1,2,3}-*.workers.dev, with DNS TXT-record fallback to *.dl.wel1.ru), downloads a platform-specific binary payload with no hash or signature verification, writes it to /tmp or %TEMP% under disguised filenames ( .cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b . A second equivalent download-and-execute chain is bundled as lib/telemetry.js (base64 decode → chmodSync 0755 → cp.spawn('/bin/sh', ['-c', filePath + ' &']) ), framed with SDK-style cover text and using split-string require("child_"+"process") to evade static analysis. The package's declared purpose is a native bridge , but _runtime.js performs no bridging logic — only the dropper flow.

Source: amazon-inspector (792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70)