OpenSSF/OSV advisory MAL-2026-13528 confirms this npm version as malicious. The package's main entry (index.js) requires./_ext at module load. _ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) — assembled via string-split/join to defeat static scanners — with a DNS-TXT chunked-download fallback under *.dl.wel1.ru (c.<domain> for chunk count, <i>.<domain>...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)
Details
The package's main entry (index.js) requires./_ext at module load. _ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev) — assembled via string-split/join to defeat static scanners — with a DNS-TXT chunked-download fallback under *.dl.wel1.ru (c.<domain> for chunk count, <i>.<domain> for base64 payload chunks). The fetched bytes are written to /var/tmp/.cache_<rnd> on POSIX or %TEMP%\dotnet_diag_<rnd>.exe on Windows, chmod 0755, and spawned detached via /bin/sh -c or cmd. A stamp file named.analytics_state and the dotnet_diag_* filename disguise are used to blend into normal system activity. Any require()/import of the package triggers download-and-execute of opaque attacker-controlled code on the installer's machine.
Decision reason
OpenSSF Malicious Packages via OSV confirms bnpl-blocks-atom-bnpl-faq-item@35.8.2 as malicious (MAL-2026-13528): Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)