MAL-2026-12036 Malicious code in bigops-chat-tmsg (npm)

On require() of bigops-chat-tmsg, index.js silently loads runtime.js (via a swallowed try/require appended after an empty stub class exposing init/version/configure). runtime.js selects a platform-specific asset and downloads a binary from one of three string-concatenation-obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, cf102-baf.workers.dev, cf103-070.workers.dev), writes it to /var/tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag<hex>.exe on Windows impersonating a Microsoft diagnostic tool), chmods 0755, and spawns it detached via /bin/sh -c or cmd. If HTTPS fetches fail, the code falls back to a covert DNS-TXT channel at split-string-reconstructed domains (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru): it resolves TXT records for a chunk count on c.<domain> and reassembles a base64-encoded executable from numbered subdomain TXT responses. The package name/description advertise a chat/messaging library, but the entire real behavior is the dropper; the exported API is a do-nothing stub used as cover.