MAL-2026-12608 Malicious code in claims-auth-domain (npm)

On require('claims-auth-domain'), index.js loads vendor.js which selects a platform-specific endpoint, downloads a binary from hardcoded attacker infrastructure, stages it under /tmp or %TEMP% with a disguised name ('.cache<hex>' on Unix, 'dotnet_diag_<hex>.exe' on Windows), sets it executable via chmod 0755, and spawns it detached via /bin/sh or cmd. Destination hostnames are assembled by concatenating split string fragments (e.g. ['oob-worker.cf101-ad','f.work','ers','.d','ev'].join('')) to hide the C2 domains from static inspection. If HTTPS delivery from *.workers.dev fails, _vendor.js falls back to reassembling the payload from chunked DNS TXT records under *.dl.wel1.ru: a count is fetched from c.<domain>, then N.<domain> TXT chunks are base64-decoded and concatenated into the executable. Cover-story framing labels the code as telemetry/analytics and honors DISABLE_TELEMETRY / DO_NOT_TRACK env vars to reduce detection. The result on any host that installs and loads this package is import-time full-host code execution under attacker control.