bnpl-blocks-mobile-bnpl-text-block @35.2.2

Summary

On require of index.js, _support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback under *.dl.wel1.ru, writes the response to a temp path using masquerading filenames (.cache_*, dotnet_diag_*.exe), chmods it to 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}). Destination hostnames are assembled at runtime by array-join (e.g., ["oob-worker.cf102-baf",".wo","rke","rs.de","v"].join("")) and require("child_"+"process") is used to evade static scanners. A second bundled module lib/telemetry.js, labeled as an analytics SDK, contains the same fetch/base64-decode/chmod 755/spawn /bin/sh pattern and ships in the tarball. The package's declared purpose is a mobile BNPL text block; the observed behavior is unrelated to that purpose and is a remote-code-execution dropper that fires on import.

Source: amazon-inspector (cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d)