MAL-2026-11535 Malicious code in bigops-backend (npm)

On require(), adapter.js selects a platform-specific asset path, iterates a list of obfuscated Cloudflare Workers hostnames (assembled at runtime by joining string fragments such as ["oob-worker.cf100-416.w","orke","rs.","dev"]), downloads an opaque binary over HTTPS with no version pin and no hash verification, writes it to /var/tmp/.cache<rand> or %TEMP%\dotnet_diag_<rand>.exe under a cover-story name, chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true, stdio:"ignore"}).unref(). A DNS TXT-record fallback channel reassembles a base64 payload from numbered subdomains under *.dl.wel1.ru (hostname also constructed by split-and-join at runtime) when HTTPS is blocked. lib/telemetry.js in the same tarball contains the same dropper shape (cp.spawn to /bin/sh, chmodSync 0755, base64 reassembly from DNS chunks) behind an "Analytics SDK" cover story. The runtime hostname reconstruction, the DNS-TXT covert channel, the disguised staging paths, and the detached background execution grant arbitrary remote code execution on any host that installs or requires this package.