MAL-2026-12243 Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)

On require of the package's main entry, vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under oob-worker.cfNNN-XXX.workers.dev (host strings assembled via split-and-join fragments to evade static analysis) and, on failure, reassembles a base64-encoded payload from sequential DNS TXT record lookups against subdomains of *.dl.well1.site (tin.dl.well1.site, ldr.dl.well1.site). The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe,.analytics_state), chmod 0755, then spawned detached via spawn('/bin/sh', ['-c', '<fp> &']) on Unix or spawn('cmd', ['/c','start','/b',...]) on Windows. There is no version pinning, no hash or signature verification, and comments frame the behavior as 'telemetry/analytics' unrelated to the package's advertised Tinkoff SDK prefill purpose. The DNS-TXT reassembly path is a covert delivery channel designed to bypass HTTPS egress filtering.