MAL-2026-12128 Malicious code in aasp-tent-aasp-tent-core (npm)

On require of the package, index.js loads compat.js, which detects the host OS/arch and fetches a per-platform native binary from author-controlled hosts whose names are assembled at runtime via array.join("") to hide them from static scanners: oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, with a DNS TXT fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site (base64 chunks reassembled from TXT records). The downloaded bytes are written under disguised names into /var/tmp or %TEMP% (e.g., dotnet_diag<hex>.exe,.cache_<hex>), chmod 0755, and detached-spawned via cp.spawn("/bin/sh", ["-c", path+" &"]) or cmd.exe /c start /b, yielding remote code execution on the installer's machine at import time. A second module lib/telemetry.js ships a near-identical dropper primitive (require("child_" + "process"), os"host" + "name", fs["chmod" + "Sync"], base64 decode + chmod 755 + spawn /bin/sh) that is not currently referenced by index.js but is staged for activation. The package is advertised as a "platform core" but ships no functionality matching that description; its only import-time effect is the binary drop-and-exec chain.