MAL-2026-12568 Malicious code in checkout-input-email-logic (npm)

On require, bridge.js assembles attacker-controlled hostnames from split-string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev) with a DNS-TXT chunked-base64 fallback across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. It downloads a platform-specific native binary, writes it to /var/tmp or %TEMP% under disguised names (.cache<hex> or dotnet_diag_<hex>.exe), chmods 0755, and spawns it detached via spawn('/bin/sh', ['-c', fp+' &']) or cmd.exe /c start /b. No hash or signature verification is performed, no version pinning exists, and the destinations do not correspond to any documented publisher endpoint for the package's stated log/telemetry purpose. Execution is gated behind a stamp file in TEMP ('.analytics_state' with a 23340s TTL) and behaves conditionally on DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK environment variables used as cover framing. Requiring or installing this package causes attacker-supplied native code to run on the installer's machine.