Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

bnpl-blocks-desktop-bnpl-image-with-caption@35.4.2: Malicious npm | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Unconsented arbitrary native code execution under the importing user's privileges.

View on npm All versions

registry / bnpl-blocks-desktop-bnpl-image-with-caption / 35.4.2

bnpl-blocks-desktop-bnpl-image-with-caption@35.4.2

Reusable bnpl blocks desktop bnpl image with caption components

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package activates a concealed remote binary loader. It downloads or DNS-reconstructs a platform payload, stores it in a temp directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any runtime import/require of index.js.

Impact

Unconsented arbitrary native code execution under the importing user's privileges.

Mechanism

remote payload download, temp-file drop, and detached execution

Attack narrative

The public entrypoint silently requires _ext.js. Its main routine fetches a binary from obfuscated worker hosts, or reconstructs one from DNS TXT records, writes it to a temporary executable path, then starts it detached via cmd.exe or /bin/sh. The state file merely throttles repeat execution and does not provide user consent or payload validation.

Rationale

This is an import-time staged remote-code-execution loader unrelated to the declared UI-component package. The absent lifecycle hook does not mitigate automatic execution when consumers import it.

Evidence

package.jsonindex.js_ext.js/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\dotnet_diag_<random>.exe

Network endpoints7

oob-worker.cf99-9b3.workers.devoob-worker.cf101-adf.workers.dev

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

oob-worker.cf103-070.workers.dev

sdk.dl.wel1.ru

ext.dl.wel1.ru

pkg.dl.wel1.ru

net.dl.wel1.ru

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js imports _ext.js on every package import.
_ext.js downloads platform binaries over HTTPS.
_ext.js falls back to DNS TXT payload retrieval.
_ext.js writes payload to /var/tmp or temp and executes it detached.
No integrity/signature verification is performed.

Evidence against

package.json has no lifecycle scripts.
The advertised index.js API is otherwise a minimal component wrapper.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 84.9 KB of source

Source & flagged code

4 flagged · loading source

_ext.jsView file

6const crypto = require("crypto"); L7: const https = require("https"); L8: ... L46: const MAX_AGE = 22541; L47: const _l = (...a) => process.stderr.write(""); L48: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_ext.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> index.js -> _ext.js L6: const crypto = require("crypto"); L7: const https = require("https"); L8: ... L46: const MAX_AGE = 22541; L47: const _l = (...a) => process.stderr.write(""); L48: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_ext.jsView on unpkg · L6

123try { L124: const cp = require("child_process"); L125: if (isWin) {

High

Child Process

Package source references child process execution.

_ext.jsView on unpkg · L123

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = nxify-unic@20.3.2 matchedPath = lib/telemetry.js matchedIdentity = npm:bnhpZnktdW5pYw:20.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

Findings

2 Critical2 High2 Medium1 Low

CriticalDownload Execute_ext.js

CriticalTrigger Reachable Dangerous Capability_ext.js

HighChild Process_ext.js

HighKnown Malware Source Similaritylib/telemetry.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

99%Block

Verdict confidence

IntentMalware

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version35.4.2

PublishedAug 5, 2026

Licensenone

Dependencies0

Integrityverified

Package size20.7 KB

Files5

Runtime surface

package.json

Entrypointsmain → index.js

RuntimeNo engine / OS / CPU constraints

Artifact85.5 KB · 7 files1 signature(s)

Install lifecycleNo scripts declared.

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkSupply chain: cleanManifest: clean

LPM CLI

Source & flagged code

4 flagged

_ext.jsView file

6const crypto = require("crypto"); L7: const https = require("https"); L8: ... L46: const MAX_AGE = 22541; L47: const _l = (...a) => process.stderr.write(""); L48: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Download Execute

Source downloads or fetches remote code and executes it.

_ext.jsView on unpkg · L6

6Trigger-reachable chain: manifest.main -> index.js -> _ext.js L6: const crypto = require("crypto"); L7: const https = require("https"); L8: ... L46: const MAX_AGE = 22541; L47: const _l = (...a) => process.stderr.write(""); L48: ... L58: const isWin = _p("platform") === "win32"; L59: const dir = isWin ? (process.env.TEMP || process.env.TMP || "C:\\Windows\\Temp") : "/tmp"; L60: return path.join(dir, isWin ? "analytics_state" : ".analytics_state"); ... L94: try { L95: require("dns").resolveTxt(d, (e, rr) => { L96: if (e || !rr || !rr.length) return r("");

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

_ext.jsView on unpkg · L6

123try { L124: const cp = require("child_process"); L125: if (isWin) {

High

Child Process

Package source references child process execution.

_ext.jsView on unpkg · L123

lib/telemetry.jsView file

•matchType = normalized_sha256 matchedPackage = nxify-unic@20.3.2 matchedPath = lib/telemetry.js matchedIdentity = npm:bnhpZnktdW5pYw:20.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg