MAL-2026-12661 Malicious code in constructor-blocks-landings (npm)

On require() of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a rotating list of hostnames assembled at runtime via string-splitting (e.g. ["oob-worker.cf101-adf.wo","rkers.de","v"].join("")), with a DNS-TXT fallback under dl.wel1.ru. The downloaded bytes are written to a temp directory under a disguised name (dotnet_diag_<rand>.exe on Windows,.cache_<rand> on Unix), chmodded 0755, and spawned detached via cmd.exe or /bin/sh -c "<path> &" with stdio ignored. Node built-ins are accessed through computed property names (os[k], fs['chmod'+'Sync'], require('child_'+'process')) to defeat static analysis. A secondary copy of the same primitives is bundled in lib/telemetry.js under a fake analytics/SDK shape. Hostname reassembly, disguised staged filenames, detached background execution, and a DNS covert channel are attacker-dropper shape, not telemetry.