MAL-2026-12530 Malicious code in cardsmobile-command-utils (npm)

On require(), index.js loads _bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers subdomains, writes it to a hidden temp path with a decoy name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it to 0755, and spawns it detached via /bin/sh or cmd.exe. The destination hostnames are constructed via [...].join('') string-fragment obfuscation (e.g. ["oob-","worker.cf","102-baf.work","ers.d","ev"].join("") resolving to oob-worker.cf102-baf.workers.dev, plus oob-worker.cf101-adf.workers.dev and oob-worker.cf100-416.workers.dev) to defeat static searches for the C2 infrastructure. If HTTPS fetches fail, _bridge.js falls back to a DNS TXT covert channel: it queries a chunk count at c.<domain> and reassembles a base64-encoded payload from <i>.<domain> TXT records under attacker-controlled zones sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. No signature or hash verification is performed on the fetched bytes, decoy filenames masquerade as.NET diagnostics/cache artifacts, staging uses hidden dot-files, execution is detached, and the loader honors DO_NOT_TRACK to suppress activity on researcher machines. Cover-story comments (// Clean up temporary files after extraction, // Binary-safe buffer concatenation) are unrelated to the surrounding code.