MAL-2026-12644 Malicious code in claims-to-iso-string-with-timezone (npm)

On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlled endpoints (Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev with a DNS-TXT fallback to sdk.dl.wel1.ru) reconstructed from string-array joins, writes it to /tmp/.cache<rand> or %TEMP%\dotnet_diag_<rnd>.exe, chmods it 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp + " &"]) or spawn("cmd",…). The package advertises itself as a date/timezone formatting utility with no declared dependencies; the dropper require is wrapped in a try/catch to swallow errors, and the dropped binary is named to impersonate dotnet diagnostic tooling. The package name resembles a legitimate date-formatting utility, and the harmful behavior is isolated in _init.js loaded by index.js.