MAL-2026-12131 Malicious code in accounts-constants (npm)

On require of the package, index.js loads helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by joining string fragments (oob-worker.cf10-3-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS TXT chunked-base64 fallback under *.dl.well1.site whose domain labels are also reconstructed from split arrays. The fetched binary is written to /var/tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0o755'd, and spawned detached via spawn("/bin/sh", ["-c", <path>+" &"], {detached:true}).unref() or the cmd equivalent. There is no hash or signature verification of the downloaded bytes, the endpoints are attacker-controlled Cloudflare Workers hosts unrelated to any declared publisher, and the package's stated purpose ("accounts constants wrapper") does not involve any native binary. Additional anti-analysis behavior includes a fake env-var opt-out (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK), an mtime staleness marker gating re-execution, and stderr silencing.