bnpl-blocks-desktop-bnpl-anchor-title@35.2.5
Vulnerability report · Last retrieved from osv.dev October 8, 2026 at 6:41 AM UTC
OSV ID
MAL-2026-12912
Ecosystem
npm
Summary
On require() of this package, _bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) and fallback hosts under dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to a temp path, sets it executable (chmod 0755), and spawns it detached via /bin/sh -c (with a cmd branch for Windows). The destination hostnames and API names are reassembled at runtime from split string fragments (e.g. ["oob-wo","rker.cf1","01-adf",".wo","rkers",".dev"].join(""), fs["chmod"+"Sync"]) to evade literal-string scanning. The binary is fetched unpinned and unverified from non-publisher infrastructure; the package presents an analytics/telemetry cover story. lib/telemetry.js contains parallel dropper primitives (base64-chunked reassembly, chmod-to-755, detached /bin/sh spawn) as a staged variant.
Source: amazon-inspector (67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.