MAL-2026-12534 Malicious code in cardsmobile-notifications (npm)

On require() of cardsmobile-notifications, index.js loads support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT covert-channel fallback that assembles a base64 payload from numbered subdomains under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (dotnet_diag.exe,.cache_), chmod 0755, and spawned detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref(). No hash or signature verification is performed; the destinations are not the publisher; the C2 hostnames are assembled via string-split.join("") to evade static matching. A second 81KB module lib/telemetry.js, disguised as an APM/telemetry SDK, contains the same base64-decode + chmod 0755 + /bin/sh spawn pattern; it is not reached from index.js in this version but is armed and could be re-wired by a future release.