MAL-2026-12170 Malicious code in bigops-info-notices (npm)

On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers hosts whose hostnames are reconstructed via array-join concatenation (e.g., ["oob-worker.cf99-9","b3.workers",".d","ev"].join("")), writes the payload to a temp path under a disguised name (dotnet_diag*.exe,.cache*,.analytics_state), chmods it 0755, and detach-executes it via spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) on Unix or spawn("cmd",…) on Windows. A DNS-TXT covert channel over sdk.dl.wel1.ru (also assembled via join) serves as a fallback delivery path, reading a chunk-count TXT record from c.<domain> and reassembling base64 chunks from N.<domain>. The package manifest describes it as an "Internal bigops info notices module for platform services" with a stub API and no dependencies, consistent with a dependency-confusion or typosquat lure whose sole effect on install/require is to drop and execute an attacker-controlled binary.