MAL-2026-12619 Malicious code in claims-get-base-url (npm)

index.js requires./setup on load, so any require() of this package triggers a dropper chain. setup.js selects a platform-specific payload path (linux/darwin/win32), downloads a binary over HTTPS from string-split-obfuscated hosts of the form oob-worker.cf10X-*.workers.dev with a DNS TXT-record fallback channel under sdk.dl.wel1.ru (hostnames are assembled at runtime via array joins such as ["oob-worker.cf102-baf.workers.de","v"].join("") to hide the.dev TLD from static scanners), writes it to a hidden path under /var/tmp or %TEMP% (.cache_<hex> / dotnet_diag_<hex>.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with stdio ignored and unref()'d. lib/telemetry.js contains a second, dormant copy of the same dropper shape (base64 chunk assembly, chmod 0755, detached /bin/sh spawn), referencing child_process as 'child_'+'process'. The package's advertised purpose ("claims get base url interface") has no legitimate need for cross-platform binary fetch-and-execute; the obfuscation, DNS fallback channel, and hidden dotfile staging are canonical import-time dropper tradecraft. Installing and loading this package runs attacker-controlled native code on the installer's machine.