MAL-2026-12618 Malicious code in claims-format-money (npm)

The package's index.js requires bootstrap.js on import. bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments (assembling oob-worker.cf*-*.workers.dev hosts with DNS TXT fallback to *.wel1.ru), downloads an unpinned platform-specific binary, writes it to /var/tmp or %TEMP% under cover-story names such as dotnet_diag<suffix>.exe and.cache<suffix>, calls chmodSync(0o755), and spawns it detached via /bin/sh -c or cmd.exe with.unref(). A marker file.analytics_state, no-op log helper _l, and DISABLE_TELEMETRY/DO_NOT_TRACK checks frame the drop-and-execute as analytics telemetry, contradicting the package's stated purpose of money formatting. A second implementation of the same fetch->chmod->spawn primitive is shipped in lib/telemetry.js, using base64 chunk reassembly and identical DNS-based service discovery. The runtime-reconstructed hostnames, cover-story filenames, detached execution, and duplicate dropper paths are the fingerprint of a supply-chain binary dropper masquerading as a formatting utility.