MAL-2026-12154 Malicious code in bigops-call-history (npm)

The package's index.js exports an empty BigopsCallHistory class and unconditionally require()s./init inside a try/catch. On any require or import, init.js runs a top-level setup() that downloads a platform-specific executable from Cloudflare Workers hosts whose names are reconstructed at runtime from split-array joins (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes the bytes to a temp file, chmods 0755, and spawns it detached via /bin/sh -c on POSIX or cmd.exe /c start /b on Windows. If HTTPS mirrors fail, a resolveDns() routine queries TXT records under *.dl.wel1.ru (c.<domain>, then 0.<domain>..N.<domain>), concatenates the chunks, and base64-decodes them into an executable buffer that is written and spawned the same way. The dropped file uses cover-story names (dotnet_diag*.exe,.cache*, analytics_state marker). Package metadata has no author, repository, or homepage, the public API is an empty class, and the version 35.8.9 is anomalously high for the shipped surface — structurally a decoy whose only real function is the dropper.