MAL-2026-12571 Malicious code in checkout-mobile-accounts-old (npm)

On require() of checkout-mobile-accounts-old, index.js loads support.js which downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT covert-channel fallback under wel1.ru (sdk./ext./pkg./net.dl.wel1.ru), stages the payload under /var/tmp or %TEMP% with disguised filenames (dotnet_diag.exe,.cache_), chmods 0755 on POSIX, and spawns it detached via /bin/sh -c or cmd. The C2 hostnames are assembled at runtime by joining split string literals, and the DNS fallback reassembles a base64-encoded binary from numbered TXT records (c.<domain> for chunk count, 0..n.<domain> for chunks). Environment variables DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK, plus a cooldown flag file, are checked to suppress the fetch. The delivery, obfuscation, disguised staging path, detached execution, and DNS-TXT fallback channel are all unrelated to the package's stated device-integration purpose and constitute full-host remote code execution against any installer that requires the package.