bnpl-blocks-post-css @35.5.4

Summary

On require(), _polyfill.js reconstructs attacker-controlled hostnames from string-split fragments (oob-worker.cf103-070.workers.dev, with a DNS-TXT fallback via sdk.dl.wel1.ru), downloads a platform-specific native binary, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0o755, and spawns it detached via spawn('/bin/sh', ['-c', <path> + ' &'], {detached:true}) or the cmd equivalent. lib/telemetry.js contains a second implementation of the same fetch->write->chmod 755->spawn pattern with a base64-decoded payload under an analytics-SDK cover story. The package is advertised as a CSS-blocks utility and has no legitimate reason to fetch and execute native binaries; the string-split obfuscation of the download hosts and the 'analytics_state' / DISABLE_TELEMETRY cover-story naming further confirm hostile intent.

Source: amazon-inspector (dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c)