MAL-2026-12617 Malicious code in claims-format-masked-phone-number (npm)

The package advertises phone-number masking but on every require() loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque native binary from one of four hardcoded Cloudflare Workers subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev). The hostnames are assembled at runtime via.join() over fragmented string arrays to defeat static scanners. The fetched bytes are written to /var/tmp/.cache<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and detached via /bin/sh -c "<path> &" or cmd /c start with no hash or signature verification. A fallback channel issues DNS TXT queries against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru, concatenates the chunked TXT responses, and base64-decodes them into an executable buffer that is dropped and run the same way. Cover-story elements (file names like.analytics_state and dotnet_diag_*.exe, comments about telemetry opt-out, DISABLE_TELEMETRY/DO_NOT_TRACK env checks) do not match the package's stated purpose and no binary distribution is part of a phone-number masking library.