MAL-2026-12601 Malicious code in checkout-use-disable-interaction (npm)

On require() of checkout-use-disable-interaction, index.js loads vendor.js which downloads a platform-specific native binary from Cloudflare Workers subdomains under oob-worker.cf*.workers.dev, with a DNS TXT-record fallback channel at c.<domain> and 0.<domain>..N.<domain> under *.dl.wel1.ru whose base64-decoded fragments are concatenated into the same executable payload. Destination hostnames are assembled at runtime by string-splitting and array-join to evade static analysis. The payload is written to /var/tmp/.cache<uid> on Linux/macOS or %TEMP%\dotnet_diag_<uid>.exe on Windows — cover-story filenames designed to blend with system artifacts — then chmod 0755 and spawned detached via /bin/sh -c '<path> &' or cmd /c start /b. A /tmp/.analytics_state (or %TEMP%\analytics_state) marker file is written and its mtime used as a ~6h re-run gate so the dropper re-fires periodically whenever any consumer imports the package. The package README advertises a benign microservice module; the shipped code does not match that purpose.