MAL-2026-12677 Malicious code in delivery-ci-notify (npm)

On require() of delivery-ci-notify, index.js loads shim.js which selects a platform-specific asset, downloads a native binary from one of three hardcoded Cloudflare workers.dev hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev) with hostnames assembled at runtime via Array.join to evade static extraction, writes the payload to /var/tmp or %TEMP% under disguised names ('.cache<hex>' on Unix, 'dotnet_diag_<hex>.exe' on Windows), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe. If the HTTPS fetch fails, the shim falls back to a DNS TXT covert channel under *.dl.wel1.ru (sdk/ext/pkg/net subdomains), retrieving a chunk count from c.<domain> and reassembling numbered TXT records via base64 into the same executable. Execution is gated by a TTL state file '.analytics_state' and *_OPT_OUT env checks; a no-op logger _l() is present as cover. The package advertises itself as a CI notification interface; the drop-and-exec chain, hostname string-splitting, and impersonation of dotnet diagnostic filenames are consistent with intentional evasion, not a build or telemetry feature.