MAL-2026-12663 Malicious code in constructor-blocks-renderer-landings (npm)

On import, the package's main entry (index.js) unconditionally loads polyfill.js, which fetches a platform-specific executable from one of four hardcoded Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev) assembled via runtime string-joining, writes it to /var/tmp or %TEMP% under cover-story filenames (.cache<hex>, dotnet_diag_<hex>.exe), chmods it to 0755, and spawns it detached via /bin/sh -c or cmd. A DNS-TXT covert-channel fallback under *.dl.wel1.ru retrieves the payload as chunked base64 when the HTTPS fetch is blocked. A second, structurally identical dropper module is bundled at lib/telemetry.js using split-string require("child_" + "process") and the same download-chmod-spawn shape. Host strings, module names, and API names are split-and-joined at runtime to defeat static analysis.