MAL-2026-12598 Malicious code in checkout-total-logic (npm)

On require of the package, index.js loads platform.js, which reconstructs endpoint hostnames from split string fragments resolving to oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, and oob-worker.cf102-baf.workers.dev, with a DNS TXT-record chunked-base64 fallback channel over .dl.wel1.ru. platform.js:74 issues https.get to those hosts, writes the returned platform-specific binary to a temp path using decoy filenames (dotnet_diag.exe,.cache*), chmods it 0o755 on Unix, and detached-spawns it via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}) on Unix or spawn('cmd',…) on Windows. There is no hash or signature verification, the destination hosts are not publisher-associated, and the package presents itself as a trivial log transport, contradicting the fetch-and-execute behavior. A cooldown flag is dropped in /tmp. The result is unauthenticated remote code execution on any developer or CI host that installs and requires this package.