MAL-2026-12646 Malicious code in claims-use-base-analytics (npm)

[email protected] is a native-binary dropper disguised as an analytics wrapper. On require, index.js loads shim.js which selects a platform-specific asset path and fetches an opaque binary via HTTPS from one of three attacker-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The binary is written to /tmp or %TEMP% under a disguised name (e.g. dotnet_diag<rnd>.exe on Windows,.cache_<rnd> on Unix), chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. If the HTTPS fetch fails, loadViaDns() reassembles a base64-encoded payload from TXT records under per-platform subdomains of dl.wel1.ru (sdk., ext., pkg., net.) — a DNS-over-TXT covert channel designed to bypass HTTP egress filtering — then writes, chmods, and executes the resulting bytes. C2 hostnames are string-split-obfuscated (e.g. ["oob-worker.cf100-416.w","orke","rs",".dev"].join("")) and require("child_" + "process") is used to evade static analysis. Execution is gated by a ~6h TTL cache stamp in.analytics_state so it fires at most once per interval, and DISABLE_TELEMETRY / DO_NOT_TRACK env vars are honored as cover for an ostensibly benign analytics stub. The package's advertised purpose (analytics wrapper) has no legitimate need for a native-binary dropper, a covert DNS-TXT fallback, or hostname obfuscation.