Malicious code in bnpl-blocks-atom-bnpl-image-card (npm)
The npm package bnpl-blocks-atom-bnpl-image-card version 35.6.1 contains malicious code that downloads and executes a native binary from Cloudflare Workers hostnames and fallback DNS-TXT records. The binary is saved under a disguised filename mimicking a Microsoft diagnostics tool and executed detached from the main process. This behavior is unrelated to the package's declared UI image card functionality.
AI Analysis
Technical Summary
The package bnpl-blocks-atom-bnpl-image-card (npm) version 35.6.1 includes code that, upon require(), loads a script which dynamically assembles URLs to fetch a binary executable over HTTPS from Cloudflare Workers hostnames and fallback DNS-TXT records from wel1.ru subdomains. The binary is saved to temporary directories with filenames designed to evade detection and is executed detached from the main process. No version pinning or integrity verification is performed on the downloaded binary. This malicious behavior is inconsistent with the package's stated purpose as a UI image card component.
Potential Impact
The malicious code enables arbitrary native code execution on the host system by downloading and running an unverified binary. This can lead to full system compromise depending on the payload of the fetched binary. The execution is detached and disguised, complicating detection and response.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using version 35.6.1 of bnpl-blocks-atom-bnpl-image-card. Verify package integrity before installation and consider removing this package from projects. Monitor for updates or advisories from the package maintainers or npm security teams.
Malicious code in bnpl-blocks-atom-bnpl-image-card (npm)
Description
The npm package bnpl-blocks-atom-bnpl-image-card version 35.6.1 contains malicious code that downloads and executes a native binary from Cloudflare Workers hostnames and fallback DNS-TXT records. The binary is saved under a disguised filename mimicking a Microsoft diagnostics tool and executed detached from the main process. This behavior is unrelated to the package's declared UI image card functionality.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The package bnpl-blocks-atom-bnpl-image-card (npm) version 35.6.1 includes code that, upon require(), loads a script which dynamically assembles URLs to fetch a binary executable over HTTPS from Cloudflare Workers hostnames and fallback DNS-TXT records from wel1.ru subdomains. The binary is saved to temporary directories with filenames designed to evade detection and is executed detached from the main process. No version pinning or integrity verification is performed on the downloaded binary. This malicious behavior is inconsistent with the package's stated purpose as a UI image card component.
Potential Impact
The malicious code enables arbitrary native code execution on the host system by downloading and running an unverified binary. This can lead to full system compromise depending on the payload of the fetched binary. The execution is detached and disguised, complicating detection and response.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using version 35.6.1 of bnpl-blocks-atom-bnpl-image-card. Verify package integrity before installation and consider removing this package from projects. Monitor for updates or advisories from the package maintainers or npm security teams.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13529
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75f712bf8831d53984fbab
Added to database: 08/07/2026, 15:17:38 UTC
Last enriched: 08/07/2026, 15:43:28 UTC
Last updated: 08/07/2026, 15:43:28 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.