Malicious code in bnpl-blocks-atom-bnpl-loader (npm)
The npm package bnpl-blocks-atom-bnpl-loader contained malicious code that downloads and executes platform-specific native binaries from Cloudflare Workers and Russian domains upon import. The package was advertised as a BNPL loader but had no legitimate reason to fetch and run opaque binaries.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed or required bnpl-blocks-atom-bnpl-loader
- Ecosystems
- Attack vectors
- Affected entities
- bnpl-blocks-atom-bnpl-loadernpm package containing malicious code in index.js and setup.js
The npm package bnpl-blocks-atom-bnpl-loader was found to contain malicious code designed to download and execute native binaries on any require/import. The attack chain begins in index.js, which loads setup.js and reconstructs obfuscated hostnames from split string fragments.
The malware downloads platform-specific binaries (linux_x64, linux_arm64, darwin, win32) over HTTPS from oob-worker.cf*.workers.dev domains. Downloaded binaries are written to temporary directories (/var/tmp on Unix, %TEMP% on Windows) under disguised names—.cache_ on Unix systems and dotnet_diag_.exe on Windows to masquerade as a .NET diagnostic tool. The binaries are then executed detached via shell spawning.
To evade detection, the package implements multiple evasion techniques: hostnames and fallback domains are constructed at runtime from split arrays to defeat static analysis, a .analytics_state cache file suppresses repeated execution, and environment variable checks (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) provide a false telemetry cover story. If HTTPS is blocked, a covert DNS-TXT fallback retrieves base64-encoded payloads from Russian domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru).
A decoy Sentry-styled analytics SDK (~81KB) in lib/telemetry.js contains the same download-and-spawn logic but is not referenced by the import chain, further reinforcing the false telemetry narrative.
Indicators of compromise
- Packages
- bnpl-blocks-atom-bnpl-loader
- Domains
- oob-worker.cf.workers.dev
- sdk.dl.wel1.ru
- ext.dl.wel1.ru
- pkg.dl.wel1.ru
- net.dl.wel1.ru
Remediation
- Immediately uninstall bnpl-blocks-atom-bnpl-loader from all affected projects
- Audit package.json and lock files for any direct or transitive dependencies on this package
- Review system logs and process execution history for suspicious binary spawning from /var/tmp, %TEMP%, or similar temporary directories
- Check for presence of .cache_ or dotnet_diag_*.exe files in temporary directories and remove if found
- Monitor network traffic for connections to oob-worker.cf*.workers.dev and wel1.ru domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update to a clean version of any legitimate BNPL loader package if needed
- Consider running affected systems through malware scanning tools to detect any dropped payloads
Sources
- GitHub Advisory GHSA-6mhg-r89q-x458 · GitHub Advisory Database
Cite this entry
"Malicious code in bnpl-blocks-atom-bnpl-loader (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-bnpl-blocks-atom-bnpl-loader-npm-5zmpb2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in mutex-thread (npm)
The npm package mutex-thread contained injected malicious code that spawns obfuscated dropper payloads, exfiltrates host reconnaissance data to Slack and Telegram, and executes remotely-controlled commands fetched from an Ethereum smart contract on Sepolia testnet.
npmCompromised packageMalicious commit - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in agora402-payment-utils (npm)
The npm package agora402-payment-utils contains malicious code that replaces caller-supplied recipient addresses with a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08) in payment routing functions. Additionally, a postinstall script exfiltrates installer metadata to an external webhook without consent.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @mohamed_nowisar/token3-check (npm)
The npm package @mohamed_nowisar/token3-check contained malicious code in preinstall, install, and postinstall lifecycle hooks that exfiltrated system and CI environment information to a third-party webhook endpoint without user consent.
npmCompromised packageMalicious commit