MAL-2026-12597 Malicious code in checkout-todo-test (npm)

On require of this package, index.js loads _platform.js, which asynchronously downloads a platform-specific binary from anonymous Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT covert-channel fallback that reassembles a base64 payload from numbered subdomain records under *.dl.wel1.ru. The destination hostnames are assembled at runtime by joining split string fragments to evade static analysis. The downloaded bytes are written to a temp path with a disguised name (.cache_XXXX on Unix, dotnet_diag_XXXX.exe on Windows), chmod 0755 on Unix, and executed via cp.spawn("/bin/sh", ["-c", fp + " &"], {detached:true}) or cmd.exe /c start /b. There is no hash or signature verification, and the hosts are not publisher-controlled infrastructure. The tarball also ships an unreferenced sibling module lib/telemetry.js (~81 KB) containing the same download→chmod→spawn pattern as latent staged code. The package presents its behavior as "telemetry/analytics" with env-var opt-outs, but the runtime-reconstructed C2 destinations, DNS covert channel, and disguised on-disk artifacts are inconsistent with legitimate telemetry.