MAL-2026-12544 Malicious code in checkout-base-test (npm)

On require() of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split string fragments joined at runtime (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev), selects a platform-specific endpoint, fetches an opaque binary via https.get, writes it to /var/tmp or %TEMP% under a disguised filename (.cache<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via spawn("/bin/sh", ["-c",…]) or spawn("cmd",…). A DNS-TXT chunked base64 covert-channel fallback contacts *.dl.wel1.ru when the HTTPS hosts are unreachable. Additional evasion: require("child_" + "process") string concatenation in lib/telemetry.js, environment-variable gating on DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK, and a filesystem session stamp to fire once per host. The disguised filenames (dotnet_diag_,.cache_) impersonate legitimate diagnostic artifacts. The package name resembles a checkout/test utility but ships no functionality matching that purpose.