MAL-2026-12578 Malicious code in checkout-mobile-pay-widget (npm)

[email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require() of the package, index.js unconditionally loads adapter.js, which at module load selects a platform-specific payload, downloads it from one of four Cloudflare Workers mirrors whose hostnames are reconstructed at runtime via array-join splits (e.g. ["oob-worker.cf101-adf.worke","rs.dev"].join("")), with a DNS-TXT chunked base64 covert channel over *.dl.wel1.ru as fallback. The downloaded bytes are written to /tmp/.cache<hex> on Unix or %TEMP%\dotnet_diag_<hex>.exe on Windows — cover-story names impersonating benign runtime artifacts — chmod'd 0755, and spawned detached via /bin/sh -c "<path> &" or cmd /c start /b. A stamp file /tmp/.analytics_state gates re-execution (EXPIRE_SEC=22056), stderr is stubbed to no-ops, and DISABLE_TELEMETRY-style env vars are honored to appear inert in sandboxes. No hash or signature verification is performed; the fetched bytes are attacker-controlled. The package advertises a native mobile-pay bridge but ships no such functionality — the only effect of installing/requiring it is the drop-and-exec chain.