MAL-2026-12590 Malicious code in checkout-resend-pos-order-sms-am (npm)

On require() of this package, index.js loads polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation (e.g. 'oob-worker.cf10x-*.workers.dev' variants) and issues an https.get to download a platform-specific executable. The bytes are written to /var/tmp/.cache<rnd> on Unix or %TEMP%\dotnet_diag_<rnd>.exe on Windows, chmodded to 0755, and spawned detached via spawn('/bin/sh', ['-c', <path> + ' &']) or the Windows equivalent. A DNS-TXT base64-chunk fallback via .dl.wel1.ru resolvers is used when direct HTTPS fetch fails. The child_process module reference and 'chmodSync' string are also concatenated at runtime ('child_'+'process', 'chmod'+'Sync') to defeat static string matching. A sibling module lib/telemetry.js contains the same fetch/chmod-0755/sh-c-spawn dropper pattern, indicating shared payload infrastructure. The package's stated purpose (an SMS/POS order helper) is unrelated to downloading and executing native binaries from Cloudflare Workers subdomains, and the disguised on-disk filenames (.cache_, dotnet_diag_*.exe) further indicate concealment rather than legitimate runtime setup.