Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)
The npm package bnpl-blocks-atom-bnpl-checkbox contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers and DNS-based fallback domains. The malicious payload is triggered on package require() via obfuscated child_process spawning.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of bnpl-blocks-atom-bnpl-checkbox without version pinning
- Ecosystems
- Attack vectors
- Affected entities
- bnpl-blocks-atom-bnpl-checkboxnpm package containing malicious code
The npm package bnpl-blocks-atom-bnpl-checkbox was found to contain malicious code embedded in _polyfill.js that executes on package import. The malicious code reconstructs network destinations using string-splitting obfuscation to evade static analysis, then fetches platform-specific binary payloads from attacker-controlled infrastructure.
The attack uses multiple delivery mechanisms: primary delivery via Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS-TXT chunked fallback via domains under wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). Downloaded bytes are written to a temporary file, made executable (chmod 0755), and spawned detached via /bin/sh.
A second dormant copy of the same malicious code pattern was discovered in lib/telemetry.js, currently unreachable from index.js but indicating intentional redundancy. The obfuscation of both the child_process import and hostname fragments, combined with false 'analytics' framing, represents deliberate evasion of automated security scanning.
The package lacks version pinning, hash verification, or signature validation, allowing the attacker to modify or update the malicious payload at will.
Indicators of compromise
- Packages
- bnpl-blocks-atom-bnpl-checkbox
- Domains
- oob-worker.cf100-416.workers.dev
- oob-worker.cf102-baf.workers.dev
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf103-070.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall bnpl-blocks-atom-bnpl-checkbox from all environments
- Audit npm package.json and lock files for any presence of this package
- Review process execution logs and network traffic for connections to the identified attacker domains (Cloudflare Workers hosts and wel1.ru subdomains)
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Implement npm package allow-listing and require explicit version pinning to prevent installation of unvetted packages
- Use npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-p6mv-5hr6-vmr2 · GitHub Advisory Database
Cite this entry
"Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-bnpl-blocks-atom-bnpl-checkbox-npm-tzb6l2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit