MAL-2026-12613 Malicious code in claims-domain (npm)

On require of the package, index.js loads _ext.js, which reconstructs destination hostnames from string-split arrays (e.g. ["oob-worker.cf99-9b3",".wor","kers.","dev"].join("")) to build URLs at oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, and oob-worker.cf102-baf.workers.dev, with a DNS TXT fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched platform-specific binary is written to /var/tmp or the Windows temp directory under disguised filenames (.cache_<hex>, dotnet_diag_<hex>.exe), chmodded to 0755, and spawned detached via /bin/sh -c or cmd /c start. The child_process module and fs.chmodSync API are also referenced through string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]) alongside cover-story comments describing the routine as an analytics/telemetry SDK. The package's advertised purpose (a claims-domain library) does not require fetching or executing native binaries from anonymous Cloudflare Workers subdomains, and the delivery is unpinned, unhashed, and obfuscated.