MAL-2026-12636 Malicious code in claims-person-domain (npm)

On require of the package's main entry, index.js loads./support.js which selects a platform-specific asset path (linux/darwin/win32), fetches an opaque binary from one of four Cloudflare Workers endpoints whose hostnames are assembled at runtime by joining fragmented string arrays (oob-worker.cf{99-9b3,101-adf,102-baf,103-070}.workers.dev), with a DNS-TXT covert-channel fallback via {sdk,ext,pkg,net}.dl.wel1.ru. The fetched bytes are written to /var/tmp or %TEMP% under disguised names (.cache<hex>, dotnet_diag_<hex>.exe), chmod'd 0755, and spawned detached via /bin/sh -c or cmd.exe. A persistence marker at /tmp/.analytics_state prevents re-execution. A parallel dropper implementation is bundled in lib/telemetry.js (self-labeled 'Analytics SDK', 81KB) that base64-decodes a payload buffer and spawns it the same way; both files use runtime string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. The obfuscation, disguised filenames mimicking diagnostic tooling, DNS-TXT fallback, and dual dropper implementations have no legitimate purpose.