{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "_helpers.js",
              "sha256": "82824b061a6f8e7b3886fdd474890449b8c5146b14f701fcaa449d213626a3fd",
              "tlsh": "e7a1989a1265b0188bb0ebe0c7179816f667f6633681c1d4f79c59844fb35248372efc"
            }
          ],
          "package_integrity": [
            {
              "filename": "ded-pwa-bnpl-forms-test-demo-35.7.8.tgz",
              "hashes": {
                "sha1": "e7f58e7ba2a042d67d22b14f56617ffc7abd00c0",
                "sha512_sri": "sha512-hyeamEloD/iq7bKPL7zTWOlfypF43Cr0MYOqio2XQHc6bPtPTw7MoXHGpdDu8pAilxpR3iRInU9KUVGOcD+hew=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "ded-pwa-bnpl-forms-test-demo"
      },
      "versions": [
        "35.7.8"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017022",
        "import_time": "2026-08-07T12:51:22.558290298Z",
        "modified_time": "2026-08-07T12:32:27Z",
        "sha256": "c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e",
        "source": "amazon-inspector",
        "versions": [
          "35.7.8"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e)\nOn require() of the package, index.js loads _helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru. The destination hostnames are assembled via array.join(\u0027\u0027) string-splitting to evade static indicator scanning. The fetched payload is written to /tmp or %TEMP% under a disguised filename (.cache_\u003chex\u003e on Unix, dotnet_diag_\u003chex\u003e.exe on Windows), chmod\u0027d 0755, and spawned detached via spawn(\u0027/bin/sh\u0027, [\u0027-c\u0027, fp+\u0027 \u0026\u0027], {detached:true}) or spawn(\u0027cmd\u0027,...). There is no hash or signature verification of the downloaded binary; the destinations are not publisher-controlled; opt-out is disguised as a generic DISABLE_TELEMETRY environment variable. The dropper is reachable from the package main entry at import time, so a plain `npm install` followed by any `require()` of the package executes attacker-controlled native code on the installer\u0027s host.\n",
  "id": "MAL-2026-13532",
  "modified": "2026-08-07T12:32:27Z",
  "published": "2026-08-07T12:32:27Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ded-pwa-bnpl-forms-test-demo/v/35.7.8"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in ded-pwa-bnpl-forms-test-demo (npm)"
}