MAL-2026-12591 Malicious code in checkout-select-pos-offer-am (npm)

index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT chunked-base64 fallback via *.dl.wel1.ru, writes it to /tmp or %TEMP% under disguised filenames (.cache<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and detach-spawns it via /bin/sh -c or cmd.exe /c start /b. Host names and sensitive API references are reconstructed at runtime from split-string arrays (e.g. host strings assembled via.join('') and require('child_' + 'process'), fs['chmod' + 'Sync']) to evade static analysis, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT env checks are used as cover-story naming. lib/telemetry.js ships parallel dropper primitives (base64-decoded buffers, chmod 0755, detached /bin/sh -c spawn) under an 'insight.node' analytics SDK disguise. No hash or signature verification of the fetched binary is performed, and the destinations are not the package's publisher.