MAL-2026-12551 Malicious code in checkout-create-draft-agreement-am (npm)

On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Workers hosts whose names are assembled by joining split character arrays (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT covert fallback channel on *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) that retrieves base64-chunked payloads via c.<domain> and i.<domain> TXT queries. The fetched bytes are written to /var/tmp/.cache<uid> (or Temp\dotnet_diag_<uid>.exe on Windows), chmod 0755, and spawned detached via child_process.spawn("/bin/sh" or "cmd"). No hash or signature verification is performed, hosts are unrelated to the package's declared 'checkout draft agreement' purpose, and the TTL marker is disguised as 'analytics_state' with a self-labeled telemetry opt-out as cover.