MAL-2026-12538 Malicious code in certificates-revocation-sw (npm)

The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev and similar, assembled by joining split string fragments) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised names (.cache<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods 0755, and spawns it detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. The package advertises itself as a certificate-revocation provider but contains no such functionality; the dropper is gated by cover-story env vars (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and mislabeled with 'telemetry'/'analytics' comments. Hostname obfuscation, disguised drop paths, detached execution, and the mismatch between advertised purpose and actual behavior indicate a deliberate remote-code-execution dropper against the installer's host.