MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

[email protected] executes a dropper on module load. Its main entry index.js requires _shim.js, which selects a platform-specific asset path and downloads an opaque native binary over HTTPS from hardcoded oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and oob-worker.cf103-070.workers.dev hosts, with a DNS TXT-record fallback that reassembles base64 chunks from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Destination hostnames and the child_process require are built at runtime by joining fragmented substrings to evade static scanners. The downloaded bytes are written to /var/tmp/.cache_<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows (disguised filenames), chmod 0755, and spawned detached via /bin/sh -c "<path> &" or cmd.exe /c start /b. A parallel dropper with the same download-chmod-spawn shape is bundled as lib/telemetry.js (~81KB) under an analytics-SDK cover story and is not currently wired from the entry points but ships in the tarball.