MAL-2026-12155 Malicious code in bigops-chat-files-hub-client (npm)

The package's main entry index.js require()s./shim, which on load fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) with a *.dl.wel1.ru fallback, writes it to a temp path as dotnet_diag<hex>.exe or.cache_<hex>, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hostnames are reconstructed at runtime from split string fragments joined with.join("") to hide them from static inspection. A second dropper module lib/telemetry.js (81 KB) ships in the tarball with the same base64-chunk decode + spawn + chmod 0755 mechanics wrapped in Sentry-like class names; it is not on the reachable require() graph in this version but is present for future activation. Telemetry-themed filenames and opt-out env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) provide cover. The stated purpose (chat files hub client) has no legitimate need to fetch and execute native binaries from anonymous edge-worker hosts.