bnpl-blocks-stories-of-block @35.8.1

Summary

On require() of this package, index.js loads _bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of attacker-controlled Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), writes it to a temp path with a disguised name (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on POSIX), chmods it to 0755, and spawns it detached via cmd.exe /c start or /bin/sh -c. Destination hostnames are reassembled at runtime via array split +.join("") to evade static analysis, and child_process is required as require("child_"+"process"). If the HTTPS mirrors fail, _bootstrap.js falls back to a DNS-TXT covert channel under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru): it queries a count record and N sequential TXT records, base64-decodes and concatenates them into an executable buffer, then writes and spawns it with no signature or hash verification. Cover-story naming (analytics_state marker, dotnet_diag_*.exe, DISABLE_TELEMETRY/DO_NOT_TRACK env opt-outs) does not alter that this is arbitrary remote code execution on the installer's host on module load.

Source: amazon-inspector (a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121)