MAL-2026-12520 Malicious code in caen-caen-core (npm)

The package's main entry (index.js) loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf10{1,2,3}-*.workers.dev) with a DNS-TXT base64 fallback resolving via {sdk,ext,pkg,net}.dl.wel1.ru, writes it to /tmp or %TEMP% under deceptive names (.cache<hex>, dotnet_diag<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. No hash or signature verification is performed. Hostnames are reconstructed at runtime by Array.join over split string fragments to evade static analysis, and the module presents an 'analytics'/telemetry cover story with DISABLE_TELEMETRY-style env gates. A secondary dropper in lib/telemetry.js contains the same shape with additional obfuscation: require("child_" + "process"), Buffer.from(chunks, "base64"), fs["chmod"+"Sync"], and cp.spawn("/bin/sh", ["-c", filePath + " &"]). The fetched destinations and delivered binaries are unrelated to the stated 'platform core' purpose, giving whoever controls the C2 arbitrary code execution on any machine that installs or requires this package.