MAL-2026-12699 Malicious code in devplatform-cli (npm)

On require() of devplatform-cli, index.js loads adapter.js which assembles Cloudflare Workers hostnames from string-split fragments (e.g. ["oob-worker.cf","103-070.workers.d","ev"].join("")) with a DNS-TXT chunked-base64 fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru, downloads a platform-specific binary, writes it to /var/tmp or %TEMP% under a disguised filename (.cache<hex> on POSIX, dotnet_diag_<hex>.exe on Windows), calls fs.chmodSync(path, 0o755) on POSIX, and background-spawns it detached via cp.spawn("/bin/sh",["-c",fp+" &"],{detached:true,stdio:"ignore"}) or cmd /c start /b. A sibling module lib/telemetry.js (81KB, framed as "Analytics SDK") duplicates the same fetch->write->chmod 0755->spawn /bin/sh pattern and further obfuscates dangerous APIs via require("child_"+"process") and fs["chmod"+"Sync"]. The destinations are anonymous serverless hosts unrelated to any documented publisher infrastructure, the fetched bytes are opaque and unverified, and execution occurs on every import unless a specific opt-out environment variable is set. Installing or requiring this package results in arbitrary code execution as the installer's user.