bnpl-blocks-types-gen @35.4.4
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 4:49 AM UTC
OSV ID
MAL-2026-13021
Ecosystem
npm
Summary
On require('bnpl-blocks-types-gen'), top-level code in index.js invokes setup() in _platform.js, which selects a platform-specific binary path, downloads bytes from one of three Cloudflare Workers hosts whose names are assembled from split string literals (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes them to /var/tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmods 0755, and spawns the binary detached via /bin/sh -c or cmd /c start. If the HTTPS fetch fails, a DNS TXT-record fallback under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru reconstructs a base64-chunked payload from TXT records and executes it the same way. Hostnames and the require('child_process') call are obfuscated via Array.join() from split literals to evade static analysis. Delivery is unpinned and unverified, the disguised filenames masquerade as OS cache/diagnostic files, and the fetched content bears no relation to the package's stated 'lightweight wrapper' purpose.
Source: amazon-inspector (de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.