MAL-2026-12163 Malicious code in bigops-data-storage (npm)

On require() of bigops-data-storage, index.js loads compat.js which unconditionally runs a top-level routine that downloads a native executable from hardcoded Cloudflare Workers hosts (reconstructed via array-join, e.g. 'oob-worker.cf101-a'+'df.workers.de'+'v') with a DNS-TXT fallback to *.dl.wel1.ru (counted subdomains 'c.<domain>', '0.<domain>', '1.<domain>' concatenated and base64-decoded). The fetched bytes are written to /tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows, chmod'd 0755, and executed detached via cp.spawn('/bin/sh',['-c', fp+' &'],{detached:true}).unref() or cmd.exe. Destination hostnames, the child_process import, and fs.chmodSync are assembled through string-splitting and property-name concatenation ('child_'+'process', 'chmod'+'Sync'), and payload filenames are disguised as 'dotnet_diag_*.exe' / '.analytics_state' with cover-story comments referencing telemetry and opt-out. A second, unreferenced dropper module lib/telemetry.js in the same tarball reimplements the same fetch-decode-chmod-spawn flow as an 'Analytics SDK'.