MAL-2026-12692 Malicious code in devplatform-api-endpoint (npm)

On require() of the package's main entry, index.js unconditionally loads bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers hosts whose names are constructed by concatenating fragmented string literals (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev). The downloaded bytes are written to a temp path with a masquerading filename (dotnet_diag.exe,.cache_), chmod 0755'd, and spawned detached via child_process (/bin/sh -c or cmd.exe /c start). A DNS-TXT covert-channel fallback resolves TXT records under *.dl.wel1.ru (sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru) enumerated as c.<domain>, 0.<domain>, 1.<domain>,… and base64-decodes the concatenated TXT payloads into an executable that is then written and run. Endpoint literals are fragmented (e.g., ["oob-worker.cf101-","ad","f.workers.d","ev"].join("")) purely to evade static matching. The package advertises no purpose that justifies fetching and executing remote binaries.