MAL-2026-12673 Malicious code in ded-ps-ded-ps-core (npm)

On require(), index.js loads init.js, which selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts whose names are assembled at runtime by joining split string fragments (e.g. oob-worker.cf1-01-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT covert-channel fallback to base64-chunked subdomains of wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru). The fetched binary is written to /tmp/.cache<hex> on Unix or %TEMP%/dotnet_diag_<hex>.exe on Windows — filenames chosen to mimic hidden cache and.NET diagnostics artifacts — then chmod 0755 and spawned detached via /bin/sh -c or cmd.exe start /b. lib/telemetry.js additionally constructs sensitive API names at runtime (require("child_" + "process"), fs["chmod" + "Sync"]) to evade static analysis. Requiring the package causes arbitrary attacker-controlled native code to execute on the installer's host.