MAL-2026-12536 Malicious code in cardsmobile-storage (npm)

On require(), index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked fallback via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The downloaded binary is written to /tmp or %TEMP% under a disguised name (.cache<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmod 0755 is applied on POSIX, and the file is spawned detached and unref'd via /bin/sh -c or cmd.exe/start. Host names and the child_process module name are assembled at runtime from split-string arrays (require("child_" + "process"), ["oob-worke","r.cf99-9b3",".wor","kers.d","ev"].join("")) to evade static URL/module scanners. A parallel dropper implementation with the same primitives (HTTPS with endpoint rotation, DNS-TXT base64 service discovery, fs.chmodSync 0o755, cp.spawn("/bin/sh", ["-c", filePath + " &"])) is bundled in lib/telemetry.js (81 KB, labeled as an "Analytics SDK") and shipped in the tarball as an alternate execution path.