MAL-2026-12184 Malicious code in peter-desktop-peter-big-column (npm)

On require(), index.js loads runtime.js which assembles download hostnames at runtime from split string fragments (resolving to oob-worker.cf99-9b3.workers.dev and *.dl.well1.site) and fetches a platform-specific binary via HTTPS with a DNS TXT fallback channel. The retrieved bytes are written to /tmp or %TEMP% under a disguised name (.cache<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755 is applied on POSIX, and the binary is spawned detached via /bin/sh -c '<path> &' or cmd /c start. A deduplication lockfile is disguised as an analytics stamp. lib/telemetry.js ships a second copy of the same fetch-write-chmod-spawn dropper under an 'apm.node' SDK guise. The delivered binary is attacker-controlled and opaque; string-array hostname assembly hides the destinations from static inspection.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.