bnpl-blocks-mobile-bnpl-header-search @35.3.7
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-12992
Ecosystem
npm
Summary
On require of the package's main entry, _shim.js constructs Cloudflare Workers hostnames (oob-worker.cf102-baf.workers.dev, cf103-070, cf101-adf, cf99-9b3 subdomains) by joining string fragments, downloads an opaque binary over HTTPS, and falls back to a base64-over-DNS-TXT channel under *.dl.wel1.ru (reading c.<domain> TXT for a chunk count then <i>.<domain> TXT records) when HTTPS is unavailable. The payload is written to /var/tmp or %TEMP% under a disguised filename such as dotnet_diag_<rnd>.exe or .cache_<rnd> , chmod 0755 on Unix, and spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b . A marker file ( /tmp/.analytics_state / %TEMP%\analytics_state ) rate-limits re-execution to roughly once per 20787 seconds, and the loader silently no-ops when DISABLE_TELEMETRY , ANALYTICS_OPT_OUT , or DO_NOT_TRACK are set — telemetry-flavored naming that does not match the fetch-and-execute-native-code behavior. Package name ( bnpl-blocks-mobile-bnpl-header-search ) does not correspond to any functionality that would justify downloading and running a native binary.
Source: amazon-inspector (0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.