bnpl-blocks-desktop-bnpl-anchor-title

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c)
On `require()` of this package, `_bootstrap.js` downloads a platform-specific binary from author-controlled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) and fallback hosts under dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru), writes it to a temp path, sets it executable (chmod 0755), and spawns it detached via `/bin/sh -c` (with a `cmd` branch for Windows). The destination hostnames and API names are reassembled at runtime from split string fragments (e.g. ["oob-wo","rker.cf1","01-adf",".wo","rkers",".dev"].join(""), fs["chmod"+"Sync"]) to evade literal-string scanning. The binary is fetched unpinned and unverified from non-publisher infrastructure; the package presents an analytics/telemetry cover story. `lib/telemetry.js` contains parallel dropper primitives (base64-chunked reassembly, chmod-to-755, detached /bin/sh spawn) as a staged variant.

Compromised versions (1)

• 35.2.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.