MAL-2026-12563 Malicious code in checkout-format-money (npm)

[email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js reconstructs destination hostnames from split string arrays (e.g. 'oob-worker.cf101-adf'+'.wor'+'kers.de'+'v') and DNS-TXT discovery domains under a fallback of the form sdk/ext/pkg/net.dl.wel1.ru, fetches an opaque binary over https.get, writes it to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, sets it executable with fs.chmodSync(outPath, 0o755), and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',…) on Windows. A secondary loader with the same shape is bundled in lib/telemetry.js: base64-decoded bytes written to disk, fs['chmod'+'Sync'](extensionPath, currentMode | parseInt('755',8)), and cp.spawn('/bin/sh', ['-c', filePath+' &']). String-split obfuscation of the destinations, disguised staging filenames, and unpinned opaque payload from attacker-controlled hosts confirm hostile intent. Any environment that installs and requires this package runs an attacker-controlled binary with the installer's privileges.