MAL-2026-12126 Malicious code in a.poltoradnev-package-b (npm)

On require() of the package, index.js loads bridge.js which selects a platform-specific output path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are assembled from split string fragments (oob-worker.cf100-4.16.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev), writes it to /var/tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmods 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT fallback channel reconstructs a base64 payload from numbered subdomains under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site when the HTTPS fetch fails. Destination hostnames are constructed at runtime via Array.join on split fragments to evade static analysis. The written binary is unpinned, unsigned, and unverified, and the code path fires as an import-time side effect rather than through any explicit user action; cover-story identifiers (analytics_state, dotnet_diag_, a DISABLE_TELEMETRY gate) do not correspond to installer-configured behavior.