MAL-2026-13002 Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

The package's index.js require()s runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS TXT chunked-transfer fallback via *.dl.wel1.ru subdomains, writes the bytes to /tmp or %TEMP% under a cover-story name (dotnet_diag<hex>.exe,.cache_<hex>), chmods 0755, and spawns the file detached via cp.spawn("/bin/sh", ["-c", fp + " &"]).unref() and cmd equivalents on Windows. No hash or signature verification is performed; destination hostnames are reconstructed at runtime via array split-and-join to defeat string scanners; opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and a /tmp/.analytics_state freshness marker frame the drop as telemetry. A parallel dropper implementation is bundled at lib/telemetry.js (81KB) with the same drop-and-exec shape and additional string-concatenation obfuscation of child_process and chmodSync. The destinations are attacker-controlled and unrelated to any advertised BNPL/popup SDK function; any require() of this package results in native code execution on the installer's machine.