MAL-2026-12603 Malicious code in checkout-use-toasts (npm)

On require() of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare workers.dev hosts (oob-worker.cf100/cf101/cf102-*.workers.dev) with a DNS-TXT fallback that resolves TXT records at subdomains of dl.wel1.ru and concatenates base64-decoded chunks as the payload. The bytes are written to /var/tmp/.cache<hex> (or %TEMP%\dotnet_diag_<hex>.exe on Windows) under disguised names, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. Destination hostnames are split into fragments and joined at runtime (['oob-worker.cf102-baf.wor','ke','rs','.d','ev'].join(''); ['sdk.d','l.','we','l1.','ru'].join('')) to evade static string matching. There is no signature or version pinning on the fetched payload. The package name and stated purpose (toast notifications for checkout flows) do not match downloading and executing a native binary, and the DNS-TXT covert channel is designed to bypass HTTP egress controls. Installing or importing this package results in attacker-controlled code execution on the installer's machine.