MAL-2026-12586 Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

On require(), index.js loads support.js which assembles Cloudflare Workers hostnames (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) via array-join concealment and fetches a platform-specific binary over HTTPS, with a DNS-TXT base64-chunk fallback channel served from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru and net.dl.wel1.ru. The retrieved bytes are written to a temp path with a disguised name (.cache<rnd> on Unix, dotnet_diag_<rnd>.exe on Windows), chmod 0755'd, and detached-spawned via /bin/sh -c or cmd /c start, so the payload runs at import time with the installer's privileges. A second dropper implementation with the same fetch/write/chmod 755/spawn primitives is bundled in lib/telemetry.js under an 'Analytics SDK' cover story, using concatenated API names (chmod+Sync, child_+process) and base64 buffer decoding. Package name and 'telemetry/analytics' framing are cover-story labels; the actual behavior is remote code delivery and execution on the installer's host from author-controlled infrastructure.