bnpl-blocks-mobile-bnpl-title @35.7.1

Summary

On require of the package, index.js loads _support.js, which selects a per-platform binary path, downloads bytes from a pool of obfuscated Cloudflare Workers mirrors whose hostnames are reassembled at runtime from split string fragments (e.g. oob-worker.cf103-070.workers.dev), writes the payload to a disguised temp filename such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods 0755 on POSIX, and spawns it detached via cmd.exe /c start /b or /bin/sh -c '<path> &'. If HTTPS mirrors fail, a fallback covert channel resolves DNS TXT records under *.dl.wel1.ru, reassembles a base64-encoded executable from chunked TXT responses, and executes it the same way. No hash or signature check is performed. Hostnames are hidden via split-and-join to evade static inspection. The combination of import-time execution, unpinned remote payload, non-publisher hosts with obfuscated names, DNS-over-TXT payload transport, and detached background spawn is a full-host remote code execution channel against the installer.

Source: amazon-inspector (5cf4f269562c9f3d9dd234e8c38b6d3408b636a4e743a6106dff730efce473ce)