MAL-2026-12595 Malicious code in checkout-test-component (npm)

On require() of the package, index.js loads./runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflare Workers hosts (oob-worker.cf*.workers.dev) with a DNS/TXT fallback to *.dl.wel1.ru, writes it to /var/tmp or %TEMP% under cover-story names (.cache<hex>, dotnet_diag_<hex>.exe, analytics_state), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe. Destination hostnames are constructed by fragment-and-.join("") to evade static analysis. A secondary dropper implementation is shipped as lib/telemetry.js (~81 KB) using base64 chunk decoding, cp.spawn("/bin/sh", ["-c", filePath + " &"]), and fs["chmod"+"Sync"] with 0755, framed as an analytics.node SDK — duplicating the dropper mechanism as a dormant secondary payload. The package name resembles a benign test/checkout utility but contains no such functionality; its sole effect on load is to drop and execute attacker-controlled code on the installer's host.