MAL-2026-12640 Malicious code in claims-policy-details-domain (npm)

On require() of claims-policy-details-domain, index.js loads vendor.js which downloads a platform-specific binary from anonymous Cloudflare workers.dev subdomains (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS TXT covert-channel fallback under *.dl.wel1.ru (sdk./ext./pkg./net.dl.wel1.ru) that retrieves base64-chunked payload bytes via resolveTxt of c.<domain> and <N>.<domain>. The fetched bytes are written to disguised paths in /var/tmp or %TEMP% (e.g..cache<hex>, dotnet_diag_<hex>.exe), chmod 0o755, and spawned detached via /bin/sh -c or cmd.exe /c start /b (_vendor.js line 119, 121, 125). C2 hostnames are assembled from split string fragments to evade static analysis, and generic opt-out env vars plus a TTL cache reduce re-execution and observability. The package presents as an internal-namespace SDK at an unusually high version (35.9.3) with a trivial declared surface and an 81KB stub lib/telemetry.js, consistent with a dependency-confusion lure whose only material behavior is the dropper.