MAL-2026-12688 Malicious code in delivery-ci-validate (npm)

Requiring delivery-ci-validate loads _polyfill.js, which assembles destination hostnames from split string fragments joined at runtime (e.g. 'oob-'+'worker.cf100-416.workers.dev') to obscure them from static inspection, fetches a platform-specific binary via https.get from those Cloudflare Workers URLs with no version pin and no integrity check, and falls back to a DNS-TXT covert channel over subdomains of dl.wel1.ru that pulls chunked base64-encoded payload bytes. The retrieved bytes are written to /var/tmp (or the Windows TEMP directory) under a cover-story diagnostic name, chmod'd to 0755, and spawned detached via spawn('/bin/sh',…) or spawn('cmd',…). The entry point index.js requires _polyfill.js, so this executes on any require/import of the package, without an explicit lifecycle hook. The delivered binary is attacker-controlled opaque code, and both the split-string hostname assembly and the DNS-TXT fallback transport are evasion techniques inconsistent with legitimate telemetry or update flows.