MAL-2026-12621 Malicious code in claims-get-indexed-selector (npm)

[email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network destinations from split string arrays (hosts on cf*.workers.dev and *.dl.wel1.ru), downloads a native binary over HTTPS, writes it to /var/tmp/.cache<hex> or TEMP\dotnet_diag_<hex>.exe with cover-story filenames, chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. If HTTPS retrieval fails, a covert DNS-TXT channel is used: a chunk-count TXT record at c.<domain> and base64-encoded payload chunks at <i>.<domain> are fetched and reassembled into the executable. No hash or signature verification is performed on the fetched binary. Destination hostnames are constructed from split arrays such as ["oob-worker",".cf103-070.","workers.","de","v"].join("") to evade static string scanning. The package is presented as a benign runtime support module; the delivered binary is opaque and the destinations are attacker-controlled.