MAL-2026-12169 Malicious code in bigops-header-tabs (npm)

On require() of bigops-header-tabs, index.js loads adapter.js which selects a platform-specific remote path and fetches an opaque binary from obfuscated Cloudflare Workers hosts (hostnames reconstructed by string-join, e.g. "oob-worker.cf10"+"2-baf.workers.dev"), with a DNS-TXT-record-based staged retrieval fallback via subdomains of dl.wel1.ru (c.<domain> for chunk count, i.<domain> for base64 chunks). The fetched payload is written to /tmp or %TEMP% under masquerading names (dotnet_diag,.cache_, analytics_state), chmod 0755 on Unix, and spawned detached via /bin/sh -c or cmd.exe. Execution is gated by env-var opt-outs and a stamp file to run once per host. The package README advertises only a trivial "header tabs" SDK, which does not require any native binary or child-process execution. Fingerprints present: hardcoded/reconstructed attacker C2 bound to install-time-reachable network+exec, obfuscated destination hostnames, DNS covert channel, filename masquerade, purpose mismatch between advertised functionality and shipped behavior.