MAL-2026-12622 Malicious code in claims-get-percentage-value (npm)

The package's main entry (index.js) unconditionally requires platform.js, which on module load fetches a platform-specific executable from hardcoded string-concatenated hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The fetched bytes are written to /tmp as a hidden dot-file (.cache<rand>) on Unix or to %TEMP% as dotnet_diag_<rand>.exe on Windows, chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe start /b. Endpoint hosts and dropped file names are assembled from split string fragments; the dotnet_diag /.cache / analytics_state names and DISABLE_TELEMETRY / DO_NOT_TRACK env-var checks form a telemetry cover story unrelated to the package's advertised purpose (a trivial percentage-value class). No hash or signature verification is performed on the downloaded binary.