MAL-2026-12537 Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join("") obfuscation (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), fetches an opaque platform-specific native binary via https.get, writes it to /var/tmp or %TEMP% under a decoy name (e.g. dotnet_diag<hex>.exe,.cache<hex>), chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}).unref() (or spawn("cmd",...) on Windows). A secondary DNS-TXT covert channel under sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru reconstructs a base64-encoded payload from numbered TXT records (c.<domain> count + <i>.<domain> chunks) when the HTTPS fetch fails. The binary is unpinned, unhashed, and served from anonymous Workers subdomains — arbitrary attacker-controlled code executes on any host that installs or requires the package. lib/telemetry.js contains parallel dropper primitives (split-string require("child_" + "process"), fs["chmod" + "Sync"], cp.spawn("/bin/sh",...)) staged but not currently reachable from the main entry.