MAL-2026-12133 Malicious code in accounts-forms (npm)

On require() of accounts-forms, index.js loads polyfill.js which selects a platform-specific URL and downloads an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback under *.dl.well1.site. The downloaded bytes are written to a hidden path in /tmp (as.cache<hex>) or %TEMP% (as dotnet_diag_<hex>.exe or analytics_state), chmod 0755 on POSIX, and spawned detached via /bin/sh -c or cmd /c start. Destination hostnames are split across array-joined string fragments to evade static analysis, and the dropped binary uses cover-story filenames mimicking diagnostics/analytics artifacts. An opt-out gate keyed on generic telemetry environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) further disguises the fetch-and-execute chain as telemetry. The fetched executable is unsigned, unversioned, unrelated to any documented package purpose, and delivers attacker-controlled code to the installer's host on load.