MAL-2026-12596 Malicious code in checkout-test-utils (npm)

The package presents itself as a small helper library (deepMerge/sleep/retry/chunk) but its main entry requires./support.js, which at load time downloads an opaque binary from string-fragment-obfuscated Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS TXT-based fallback that reassembles a base64 payload from sequentially numbered TXT records under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru). The fetched bytes are written to /tmp under a disguised name (e.g., dotnet_diag.exe,.cache_), chmod 0755, and executed detached via spawn('/bin/sh', ['-c', fp + ' &']). Destination hostnames are assembled via split-array joins to evade static matching (e.g., ['oob','-worker.cf103-070.w','orker','s.dev'].join('')). No hash or signature verification is performed, and the destinations are not publisher infrastructure. Any consumer that installs or requires this package auto-executes attacker-controlled code on the host.